fix: registry fallback skips dead primary, WireGuard first-boot, Gitea port 3001

Registry fallback now only tries DIFFERENT registries (skips original
that already failed). 120s timeout per fallback attempt. WireGuard
keys generated on unbundled first-boot. Gitea ROOT_URL uses port 3001.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/first-boot-containers.sh

@@ -141,6 +141,26 @@ FBEOF
         chown -R 1000:1000 /var/lib/archipelago/secrets
     fi
 
+    # Generate WireGuard keys for VPN
+    if [ ! -f /var/lib/archipelago/wireguard/wg0.conf ]; then
+        log "Generating WireGuard keys..."
+        mkdir -p /var/lib/archipelago/wireguard /etc/wireguard
+        PRIVKEY=$(wg genkey)
+        PUBKEY=$(echo "$PRIVKEY" | wg pubkey)
+        cat > /var/lib/archipelago/wireguard/wg0.conf <<WGEOF
+[Interface]
+PrivateKey = $PRIVKEY
+Address = 10.0.0.1/24
+ListenPort = 51820
+WGEOF
+        cp /var/lib/archipelago/wireguard/wg0.conf /etc/wireguard/wg0.conf
+        chmod 600 /etc/wireguard/wg0.conf /var/lib/archipelago/wireguard/wg0.conf
+        chown -R 1000:1000 /var/lib/archipelago/wireguard
+        systemctl enable wg-quick@wg0 2>/dev/null || true
+        wg-quick up wg0 2>>"$LOG" || true
+        log "  WireGuard configured: pubkey=$PUBKEY"
+    fi
+
     log "Unbundled first-boot complete"
     exit 0
 fi