feat: standalone WireGuard from first install, fix networking stack

Standalone WireGuard (wg0:51820):
- New archipelago-wg.service creates wg0 independent of NostrVPN
- Keypair generated on first-boot, persisted on LUKS partition
- vpn.create-peer uses wg genkey/pubkey (no nvpn dependency)
- wg-address service depends on archipelago-wg, not nostr-vpn

Networking fixes:
- Remove nos.lol from default relays (requires PoW, events rejected)
- Add Tor hidden service for private relay (port 7777) — NAT'd peers
  can reach relay over Tor for NostrVPN signaling
- Fix Tor hostname sync race: wait loop before copying hostname files
- Add tor-hostnames + wireguard dirs to LUKS partition setup
- Include relay in hostname sync loops (setup-tor.sh + first-boot)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/archipelago-wg-address.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=Assign WireGuard server address to wg0
-After=nostr-vpn.service
-Wants=nostr-vpn.service
+After=archipelago-wg.service
+Wants=archipelago-wg.service
 ConditionPathExists=/sys/class/net/wg0
 
 [Service]

image-recipe/configs/archipelago-wg.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Archipelago Standalone WireGuard (wg0)
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/var/lib/archipelago/wireguard/private.key
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/bin/archipelago-wg setup /var/lib/archipelago/wireguard/private.key
+ExecStop=/bin/bash -c 'ip link del wg0 2>/dev/null || true'
+
+[Install]
+WantedBy=multi-user.target