feat: initial WireGUI implementation — full VPN management platform

Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN
management platform. All 10 implementation phases delivered.

Core stack:
- NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg)
- Alembic migrations, Valkey/Redis cache, pydantic-settings config
- WireGuard management via subprocess (wg/ip/nft CLIs)
- 164 tests passing, 35% code coverage

Features:
- User/device/rule CRUD with admin and unprivileged roles
- Full device config form with per-device WG overrides
- WireGuard client config generation with QR codes
- REST API (v0) with Bearer token auth for all resources
- TOTP MFA with QR registration and challenge flow
- OIDC SSO with authlib (provider registry, auto-create users)
- Magic link passwordless sign-in via email
- SAML SP-initiated SSO with IdP metadata parsing
- WebAuthn/FIDO2 security key registration
- nftables firewall with per-user chains and masquerade
- Background tasks: WG stats polling, VPN session expiry,
  OIDC token refresh, WAN connectivity checks
- Startup reconciliation (DB ↔ WireGuard state sync)
- In-memory notification system with header badge
- Admin UI: users, devices, rules, settings (3 tabs), diagnostics
- Loguru logging with optional timestamped file output

Deployment:
- Multi-stage Dockerfile (python:3.13-slim)
- Docker Compose prod stack (bridge networking, NET_ADMIN, nftables)
- Forgejo CI: tests → semantic versioning → Docker registry push
- Health endpoint at /api/health

tests/test_services.py

@@ -0,0 +1,124 @@
+"""Tests for services — WireGuard and events."""
+
+from unittest.mock import AsyncMock, patch
+
+from wiregui.models.device import Device
+from wiregui.models.rule import Rule
+from wiregui.services.events import on_device_created, on_device_deleted, on_device_updated, on_rule_created
+
+
+def _make_device(**kwargs) -> Device:
+    defaults = dict(
+        name="test",
+        public_key="pk-test",
+        preshared_key="psk-test",
+        ipv4="10.3.2.5",
+        ipv6="fd00::3:2:5",
+        user_id="00000000-0000-0000-0000-000000000000",
+    )
+    defaults.update(kwargs)
+    return Device(**defaults)
+
+
+# --- Events (with WG enabled) ---
+
+
+@patch("wiregui.services.events.get_settings")
+@patch("wiregui.services.events.firewall")
+@patch("wiregui.services.events.wireguard")
+async def test_on_device_created_calls_add_peer(mock_wg, mock_fw, mock_settings):
+    mock_settings.return_value.wg_enabled = True
+    mock_wg.add_peer = AsyncMock()
+    mock_fw.add_device_jump_rule = AsyncMock()
+
+    device = _make_device()
+    await on_device_created(device)
+
+    mock_wg.add_peer.assert_awaited_once_with(
+        public_key="pk-test",
+        allowed_ips=["10.3.2.5/32", "fd00::3:2:5/128"],
+        preshared_key="psk-test",
+    )
+    mock_fw.add_device_jump_rule.assert_awaited_once()
+
+
+@patch("wiregui.services.events.get_settings")
+@patch("wiregui.services.events.wireguard")
+async def test_on_device_deleted_calls_remove_peer(mock_wg, mock_settings):
+    mock_settings.return_value.wg_enabled = True
+    mock_wg.remove_peer = AsyncMock()
+
+    device = _make_device()
+    await on_device_deleted(device)
+
+    mock_wg.remove_peer.assert_awaited_once_with(public_key="pk-test")
+
+
+@patch("wiregui.services.events.get_settings")
+@patch("wiregui.services.events.wireguard")
+async def test_on_device_updated_calls_add_peer(mock_wg, mock_settings):
+    mock_settings.return_value.wg_enabled = True
+    mock_wg.add_peer = AsyncMock()
+
+    device = _make_device()
+    await on_device_updated(device)
+
+    mock_wg.add_peer.assert_awaited_once()
+
+
+# --- Events (WG disabled) ---
+
+
+@patch("wiregui.services.events.get_settings")
+@patch("wiregui.services.events.wireguard")
+async def test_events_skip_when_wg_disabled(mock_wg, mock_settings):
+    mock_settings.return_value.wg_enabled = False
+    mock_wg.add_peer = AsyncMock()
+    mock_wg.remove_peer = AsyncMock()
+
+    device = _make_device()
+    await on_device_created(device)
+    await on_device_deleted(device)
+    await on_device_updated(device)
+
+    mock_wg.add_peer.assert_not_awaited()
+    mock_wg.remove_peer.assert_not_awaited()
+
+
+# --- Events (WG error handling) ---
+
+
+@patch("wiregui.services.events.get_settings")
+@patch("wiregui.services.events.firewall")
+@patch("wiregui.services.events.wireguard")
+async def test_on_device_created_handles_wg_error(mock_wg, mock_fw, mock_settings):
+    mock_settings.return_value.wg_enabled = True
+    mock_wg.add_peer = AsyncMock(side_effect=RuntimeError("wg failed"))
+    mock_fw.add_device_jump_rule = AsyncMock()
+
+    device = _make_device()
+    # Should not raise — error is logged
+    await on_device_created(device)
+
+
+# --- Rule events ---
+
+
+@patch("wiregui.services.events.get_settings")
+@patch("wiregui.services.events.firewall")
+async def test_on_rule_created_calls_apply_rule(mock_fw, mock_settings):
+    mock_settings.return_value.wg_enabled = True
+    mock_fw.apply_rule = AsyncMock()
+
+    rule = Rule(
+        action="accept",
+        destination="10.0.0.0/8",
+        port_type="tcp",
+        port_range="80",
+        user_id="00000000-0000-0000-0000-000000000000",
+    )
+    await on_rule_created(rule)
+
+    mock_fw.apply_rule.assert_awaited_once_with(
+        "00000000-0000-0000-0000-000000000000", "10.0.0.0/8", "accept", "tcp", "80",
+    )