VPN connection log: who connected and when

WireGuard has no connect events, only the last handshake and byte counters.
awg-ctrl now checks them every 30 s and writes conn_log in users.db: connect
at the first handshake, disconnect at the last activity (the last tick the
counters moved), with the session length and traffic, plus peer_seen, the
last time each peer was online. Open sessions are restored from the database,
so a restart adds no duplicates; a down interface is not a disconnect; a peer
removed mid-session is closed. Events keep the name, owner and VPN IP as of
that moment and live 90 days. Client public IPs are not recorded.

GET /api/connlog serves the events and the per-peer last-seen list. The panel
fetches it from the selected server at /ui/connlog and fills in master key
labels and device names for sen:// peers. A new "Подключения" tab shows the
event feed with search and paging, and "who was online when", including
those who never connected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bNGYiDst62wH3ZGTRPFLJ

internal/ctrl/server.go

@@ -56,6 +56,7 @@ type Server struct {
 
 	shaping *Shaping
 	torrent *Torrent
+	connlog *ConnLog
 	metrics metricsCache
 	monitor monitorJob
 	cliPath string
@@ -157,6 +158,7 @@ func New() (*Server, error) {
 	s.log.Info("awg params loaded from conf", "Jc", params.Jc, "H1", params.H1, "gen", gen)
 	s.shaping = newShaping(s)
 	s.torrent = newTorrent(s)
+	s.connlog = newConnLog(s)
 	return s, nil
 }
 
@@ -185,5 +187,6 @@ func (s *Server) Run() error {
 	go s.shaping.Apply()
 	s.shaping.Start()
 	go s.torrent.Apply() // nft-таблицы после перезагрузки нет — ставим заново
+	s.connlog.Start()
 	return <-errc
 }