feat: standalone WireGuard from first install, fix networking stack

Standalone WireGuard (wg0:51820):
- New archipelago-wg.service creates wg0 independent of NostrVPN
- Keypair generated on first-boot, persisted on LUKS partition
- vpn.create-peer uses wg genkey/pubkey (no nvpn dependency)
- wg-address service depends on archipelago-wg, not nostr-vpn

Networking fixes:
- Remove nos.lol from default relays (requires PoW, events rejected)
- Add Tor hidden service for private relay (port 7777) — NAT'd peers
  can reach relay over Tor for NostrVPN signaling
- Fix Tor hostname sync race: wait loop before copying hostname files
- Add tor-hostnames + wireguard dirs to LUKS partition setup
- Include relay in hostname sync loops (setup-tor.sh + first-boot)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -369,6 +369,7 @@ COPY archipelago-reconcile.timer /etc/systemd/system/archipelago-reconcile.timer
 COPY archipelago-tor-helper.service /etc/systemd/system/archipelago-tor-helper.service
 COPY archipelago-tor-helper.path /etc/systemd/system/archipelago-tor-helper.path
 COPY nostr-vpn.service /etc/systemd/system/nostr-vpn.service
+COPY archipelago-wg.service /etc/systemd/system/archipelago-wg.service
 COPY archipelago-wg-address.service /etc/systemd/system/archipelago-wg-address.service
 COPY nostr-relay.service /etc/systemd/system/nostr-relay.service
 COPY nostr-relay-config.toml /etc/archipelago/nostr-relay-config.toml
@@ -399,7 +400,8 @@ RUN systemctl enable NetworkManager || true && \
     systemctl enable archipelago-reconcile.timer || true && \
     systemctl enable archipelago-tor-helper.path || true && \
     systemctl enable nostr-relay || true
-# nostr-vpn and wg-address are enabled by first-boot after Nostr identity is generated
+# archipelago-wg + wg-address: enabled by first-boot after WG key is generated
+# nostr-vpn: enabled by first-boot after Nostr identity is generated
 # (env file doesn't exist until onboarding, so pre-enabling causes crash-loop)
 
 # Remove policy-rc.d so services can start on first boot
@@ -494,6 +496,10 @@ NGINXCONF
         echo "   Using nostr-vpn.service from configs/"
     fi
 
+    if [ -f "$SCRIPT_DIR/configs/archipelago-wg.service" ]; then
+        cp "$SCRIPT_DIR/configs/archipelago-wg.service" "$WORK_DIR/archipelago-wg.service"
+        echo "   Using archipelago-wg.service from configs/"
+    fi
     if [ -f "$SCRIPT_DIR/configs/archipelago-wg-address.service" ]; then
         cp "$SCRIPT_DIR/configs/archipelago-wg-address.service" "$WORK_DIR/archipelago-wg-address.service"
         echo "   Using archipelago-wg-address.service from configs/"
@@ -1357,11 +1363,14 @@ HiddenServicePort 4080 127.0.0.1:4080
 
 HiddenServiceDir $TOR_DIR/hidden_service_fedimint
 HiddenServicePort 8175 127.0.0.1:8175
+
+HiddenServiceDir $TOR_DIR/hidden_service_relay
+HiddenServicePort 7777 127.0.0.1:7777
 TORRC
 
 # Create hidden service dirs with correct ownership and permissions (700, not 750)
 # Tor refuses to start if permissions are too permissive
-for svc in archipelago bitcoin electrumx lnd btcpay mempool fedimint; do
+for svc in archipelago bitcoin electrumx lnd btcpay mempool fedimint relay; do
     mkdir -p "$TOR_DIR/hidden_service_$svc"
     chown debian-tor:debian-tor "$TOR_DIR/hidden_service_$svc"
     chmod 700 "$TOR_DIR/hidden_service_$svc"
@@ -1406,7 +1415,7 @@ done
 # Sync hostnames to backend-readable directory
 HOSTNAMES_DIR="/var/lib/archipelago/tor-hostnames"
 mkdir -p "$HOSTNAMES_DIR"
-for svc in archipelago bitcoin electrumx lnd btcpay mempool fedimint; do
+for svc in archipelago bitcoin electrumx lnd btcpay mempool fedimint relay; do
     if [ -f "$TOR_DIR/hidden_service_${svc}/hostname" ]; then
         cp "$TOR_DIR/hidden_service_${svc}/hostname" "$HOSTNAMES_DIR/$svc"
         echo "$(date): Synced hostname: $svc" >> "$LOG"
@@ -1965,7 +1974,7 @@ mkdir -p /mnt/target/var/lib/archipelago
 mount /dev/mapper/archipelago-data /mnt/target/var/lib/archipelago
 
 # Recreate directory structure on encrypted partition
-mkdir -p /mnt/target/var/lib/archipelago/{data,config,containers,secrets,tor,identities,lnd,nostr-relay,nostr-vpn}
+mkdir -p /mnt/target/var/lib/archipelago/{data,config,containers,secrets,tor,identities,lnd,nostr-relay,nostr-vpn,tor-hostnames,wireguard}
 mkdir -p /mnt/target/var/lib/archipelago/containers/storage
 mkdir -p /mnt/target/var/lib/archipelago/data/cloud/{Documents,Photos,Music,Videos,Downloads}
 # Copy relay config from rootfs (LUKS mount hides what the Dockerfile put there)