Add UDP forwarder pattern (copied from VPN client) to enable proper two-hop
tunneling where traffic flows: Client → Entry Gateway → Exit Gateway → Internet.
Key changes:
- Add udp_forwarder.go for tunnel-in-tunnel traffic forwarding
- Add wgPingTwoHop() Go function and Rust FFI bindings
- Configure NAT/iptables in localnet for gateway routing
- Remove unnecessary PSK from gateway LP registration (was breaking handshakes)
- Document known container networking instability issue (nym-vbdo)
The probe now correctly uses the entry tunnel to reach the exit gateway's
WireGuard endpoint, rather than trying to connect directly to unreachable
container-internal IPs.
durch