Make AmneziaWG 3.1 the default generation

install.sh now defaults to AWG_GEN=3.1: an incompatible module or kernel
fails with diagnostics instead of silently falling back to 2.0 and handing
out a server with weaker obfuscation. AWG_GEN=auto keeps the old fallback
for old kernels, AWG_GEN=2.0 still forces 2.0.

Servers already installed on 2.0 no longer need a reinstall: POST
/awg/upgrade (button in the users tab) backs up awg1.conf, rewrites
[Interface] with HeaderProtectionKey and the 3.1 block install.sh writes,
raises any S1-S4 below 12 (header protection needs a 12-byte nonce and the
module only reports "Invalid argument"), restarts the interface and
reissues every vpn:// key. Bringing the interface up is the only real proof
the kernel accepted the params, so a failure restores the previous conf and
brings 2.0 back up. Reissue is not optional: 2.0-era keys stop working the
moment the generation changes.

restartAwg() now re-reads the obfuscation params, generation and keepalive
from awg1.conf before syncing peers. The conf can change while the
interface is down, and a stale CONFIG.gen meant new keys were built on the
old params.

README: install from git.ma7neko.ru (Gitea) instead of raw.githubusercontent,
and document the 3.1 default with the AWG_GEN=auto escape hatch.

README.md

@@ -28,8 +28,20 @@
 На сервере, от root:
 
 ```bash
-bash <(curl -Ls https://raw.githubusercontent.com/maeneko/forgetting/main/install.sh)
+bash <(curl -Ls https://git.ma7neko.ru/maeneko/forgetting/raw/branch/main/install.sh)
 ```
+
+Установщик по умолчанию ставит сервер на AmneziaWG 3.1. Если модуль в ядре
+старше 3.x или ядро старше 5.5, установка остановится с диагностикой — поставить
+на 2.0 можно так:
+
+```bash
+AWG_GEN=auto bash <(curl -Ls https://git.ma7neko.ru/maeneko/forgetting/raw/branch/main/install.sh)
+```
+
+Перевести такой сервер на 3.1 позже можно кнопкой «Перейти на AWG 3.1» в панели —
+переустановка не нужна, пользователи сохраняются, ключи перевыпускаются
+автоматически.
 ## Управление
 
 ```bash