feat: initial WireGUI implementation — full VPN management platform

Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN
management platform. All 10 implementation phases delivered.

Core stack:
- NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg)
- Alembic migrations, Valkey/Redis cache, pydantic-settings config
- WireGuard management via subprocess (wg/ip/nft CLIs)
- 164 tests passing, 35% code coverage

Features:
- User/device/rule CRUD with admin and unprivileged roles
- Full device config form with per-device WG overrides
- WireGuard client config generation with QR codes
- REST API (v0) with Bearer token auth for all resources
- TOTP MFA with QR registration and challenge flow
- OIDC SSO with authlib (provider registry, auto-create users)
- Magic link passwordless sign-in via email
- SAML SP-initiated SSO with IdP metadata parsing
- WebAuthn/FIDO2 security key registration
- nftables firewall with per-user chains and masquerade
- Background tasks: WG stats polling, VPN session expiry,
  OIDC token refresh, WAN connectivity checks
- Startup reconciliation (DB ↔ WireGuard state sync)
- In-memory notification system with header badge
- Admin UI: users, devices, rules, settings (3 tabs), diagnostics
- Loguru logging with optional timestamped file output

Deployment:
- Multi-stage Dockerfile (python:3.13-slim)
- Docker Compose prod stack (bridge networking, NET_ADMIN, nftables)
- Forgejo CI: tests → semantic versioning → Docker registry push
- Health endpoint at /api/health

tests/conftest.py

@@ -0,0 +1,65 @@
+"""Shared test fixtures — async DB session using a test database."""
+
+from collections.abc import AsyncGenerator
+
+import pytest
+import pytest_asyncio
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlmodel import SQLModel
+
+from wiregui.config import get_settings
+
+# All models must be imported so SQLModel.metadata knows about them
+from wiregui.models import *  # noqa: F401, F403
+
+
+def _test_database_url() -> str:
+    url = get_settings().database_url
+    base, _dbname = url.rsplit("/", 1)
+    return f"{base}/wiregui_test"
+
+
+TEST_DATABASE_URL = _test_database_url()
+
+# Module-level engine creation (runs once via autouse session fixture)
+_engine = None
+
+
+def _ensure_test_db_sync():
+    """Ensure wiregui_test database exists (called once)."""
+    import asyncio
+
+    async def _create():
+        base_url = get_settings().database_url.rsplit("/", 1)[0] + "/postgres"
+        admin_engine = create_async_engine(base_url, isolation_level="AUTOCOMMIT")
+        async with admin_engine.connect() as conn:
+            result = await conn.execute(
+                text("SELECT 1 FROM pg_database WHERE datname = 'wiregui_test'")
+            )
+            if result.scalar() is None:
+                await conn.execute(text("CREATE DATABASE wiregui_test"))
+        await admin_engine.dispose()
+
+    asyncio.run(_create())
+
+
+# Create test DB once at import time
+_ensure_test_db_sync()
+
+
+@pytest_asyncio.fixture
+async def session() -> AsyncGenerator[AsyncSession]:
+    """Fresh engine + session per test, with table setup/teardown."""
+    engine = create_async_engine(TEST_DATABASE_URL)
+    async with engine.begin() as conn:
+        await conn.run_sync(SQLModel.metadata.create_all)
+
+    factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with factory() as sess:
+        yield sess
+        await sess.rollback()
+
+    async with engine.begin() as conn:
+        await conn.run_sync(SQLModel.metadata.drop_all)
+    await engine.dispose()