feat: WireGuard metrics collector + integration test stack

Metrics collector (wiregui/collector.py):
- Standalone process spawned by web app when WG_METRICS_ENABLED=true
- Polls wg show dump every WG_METRICS_POLL_INTERVAL seconds (default 5)
- Updates device stats in PostgreSQL
- Pushes Prometheus-format metrics to VictoriaMetrics (if configured)
- Graceful shutdown on SIGTERM

Integration test stack (compose.yml):
- Unified compose file for dev, test, and integration modes
- VictoriaMetrics single-node TSDB for metrics storage
- 3 mock WireGuard client containers generating ping traffic
- Automated setup script seeds server keypair, admin user, client devices
- make test-stack-up: one command to start everything
- make test-stack-verify: validates metrics flowing end-to-end

Infrastructure:
- Makefile with targets for dev, test, integration, and production
- Integration tests verify VictoriaMetrics has data for all 3 clients
- Fix Dockerfile to include img/ directory
- Separate TESTS.md for test tracking, clean TODO.md for features only

docker/mock-clients/entrypoint.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# WireGuard mock client — configures interface and generates traffic
+set -e
+
+echo "[*] Configuring WireGuard interface..."
+ip link add wg0 type wireguard
+wg setconf wg0 /etc/wireguard/wg0.conf
+ip address add "${CLIENT_IP}/32" dev wg0
+ip link set wg0 up
+
+# Route traffic to the VPN subnet through the tunnel
+ip route add 10.3.2.0/24 dev wg0
+
+echo "[*] WireGuard client up: ${CLIENT_IP}"
+echo "[*] Generating traffic to peers every ${PING_INTERVAL:-5}s..."
+
+while true; do
+    # Ping the server (first host in the subnet)
+    ping -c 1 -W 1 10.3.2.1 > /dev/null 2>&1 || true
+
+    # Ping other peers if specified
+    for peer_ip in $PEER_IPS; do
+        ping -c 1 -W 1 "$peer_ip" > /dev/null 2>&1 || true
+    done
+
+    sleep "${PING_INTERVAL:-5}"
+done