Random I1 and MTU on install

I1 becomes a DNS query to a random popular domain (A/AAAA) instead of the
shared icloud.com response every key carried. The format sticks to tags both
the kernel module and amneziawg-go accept and is checked before awg1.conf is
written: a bad I1 fails the whole awg-quick up. With KEEP_DATA=y the old I1
is kept, or generated if missing — the server never checks it, old keys keep
their own.

MTU is picked from 1320–1376 (AWG_MTU overrides) and kept on reinstall.
awg-ctrl now reads MTU from awg1.conf for vpn:// keys instead of a constant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bNGYiDst62wH3ZGTRPFLJ

internal/ctrl/params.go

@@ -70,6 +70,28 @@ var AWG31Defaults = [][2]string{
 	{"MaxHandshakeAttempts", "15-20"},
 }
 
+// DefaultMTU — MTU установок до рандомизации; запасное, если в awg1.conf его нет или оно странное.
+const DefaultMTU = 1376
+
+// ReadMTU читает MTU из [Interface] awg1.conf: install.sh выбирает его случайно, у каждого
+// сервера своё, и клиенты получают его в vpn:// ключе.
+func ReadMTU(confFile string) int {
+	raw, err := os.ReadFile(confFile)
+	if err != nil {
+		return DefaultMTU
+	}
+	iface := pPeerSplit.Split(string(raw), 2)[0]
+	m := regexp.MustCompile(`(?m)^\s*MTU\s*=\s*(\d+)`).FindStringSubmatch(iface)
+	if m == nil {
+		return DefaultMTU
+	}
+	n, _ := strconv.Atoi(m[1])
+	if n < 1280 || n > 1500 {
+		return DefaultMTU
+	}
+	return n
+}
+
 // При заданном HeaderProtectionKey ни один из S1–S4 не может быть меньше 12.
 const minSForHeaderProtection = 12