feat: initial WireGUI implementation — full VPN management platform

Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN
management platform. All 10 implementation phases delivered.

Core stack:
- NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg)
- Alembic migrations, Valkey/Redis cache, pydantic-settings config
- WireGuard management via subprocess (wg/ip/nft CLIs)
- 164 tests passing, 35% code coverage

Features:
- User/device/rule CRUD with admin and unprivileged roles
- Full device config form with per-device WG overrides
- WireGuard client config generation with QR codes
- REST API (v0) with Bearer token auth for all resources
- TOTP MFA with QR registration and challenge flow
- OIDC SSO with authlib (provider registry, auto-create users)
- Magic link passwordless sign-in via email
- SAML SP-initiated SSO with IdP metadata parsing
- WebAuthn/FIDO2 security key registration
- nftables firewall with per-user chains and masquerade
- Background tasks: WG stats polling, VPN session expiry,
  OIDC token refresh, WAN connectivity checks
- Startup reconciliation (DB ↔ WireGuard state sync)
- In-memory notification system with header badge
- Admin UI: users, devices, rules, settings (3 tabs), diagnostics
- Loguru logging with optional timestamped file output

Deployment:
- Multi-stage Dockerfile (python:3.13-slim)
- Docker Compose prod stack (bridge networking, NET_ADMIN, nftables)
- Forgejo CI: tests → semantic versioning → Docker registry push
- Health endpoint at /api/health

pyproject.toml

@@ -0,0 +1,49 @@
+[project]
+name = "wiregui"
+version = "0.1.0"
+description = "WireGuard VPN management platform — Python/NiceGUI rewrite of Wirezone"
+readme = "README.md"
+requires-python = ">=3.13"
+dependencies = [
+    # UI
+    "nicegui>=2.12",
+    # ORM & Database
+    "sqlmodel>=0.0.22",
+    "asyncpg>=0.30",
+    "alembic>=1.14",
+    # Configuration
+    "pydantic-settings>=2.7",
+    # Cache
+    "redis>=5.2",
+    # Encryption
+    "cryptography>=44",
+    # Auth
+    "bcrypt>=4.0",
+    "python-jose[cryptography]>=3.3",
+    "authlib>=1.4",
+    "pyotp>=2.9",
+    "webauthn>=2.2",
+    "python3-saml>=1.16",
+    # HTTP client
+    "httpx>=0.28",
+    # Email
+    "aiosmtplib>=3.0",
+    # QR codes
+    "qrcode[pil]>=8.0",
+    # Logging
+    "loguru>=0.7.3",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=8.0",
+    "pytest-asyncio>=0.24",
+    "pytest-cov>=7.1.0",
+    "respx>=0.22.0",
+]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "session"
+asyncio_default_test_loop_scope = "session"
+testpaths = ["tests"]