feat: standalone WireGuard from first install, fix networking stack

Standalone WireGuard (wg0:51820):
- New archipelago-wg.service creates wg0 independent of NostrVPN
- Keypair generated on first-boot, persisted on LUKS partition
- vpn.create-peer uses wg genkey/pubkey (no nvpn dependency)
- wg-address service depends on archipelago-wg, not nostr-vpn

Networking fixes:
- Remove nos.lol from default relays (requires PoW, events rejected)
- Add Tor hidden service for private relay (port 7777) — NAT'd peers
  can reach relay over Tor for NostrVPN signaling
- Fix Tor hostname sync race: wait loop before copying hostname files
- Add tor-hostnames + wireguard dirs to LUKS partition setup
- Include relay in hostname sync loops (setup-tor.sh + first-boot)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/archipelago-wg-address.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=Assign WireGuard server address to wg0
-After=nostr-vpn.service
-Wants=nostr-vpn.service
+After=archipelago-wg.service
+Wants=archipelago-wg.service
 ConditionPathExists=/sys/class/net/wg0
 
 [Service]