Add sen:// subscription with master keys

A master key is a sen:// link with a device limit. Each device
generates its own WireGuard keypair and registers only the public key,
then polls a signed /sub/v1/config, so params and generation changes
reach users without re-importing a key.

- awg-ctrl: peers table and /api/peers*, /api/profile; nextIp and
  rebuildConf take peers into account (output unchanged without them)
- awg-ui: link codec and signatures (sen.ts), registry, panel routes
  and the public listener on SUB_PORT (sub.ts)
- responses are always Ed25519-signed; TLS with a pinned self-signed
  certificate is optional
- devices report a client version, shown as platform-version
- "Мастер-ключи" tab: a table with the devices nested under each key,
  a device-limit meter, per-key settings and a placeholder for the
  servers a key serves; cards on mobile
- install.sh/CLI: subscription signing key, optional certificate, port;
  kept across reinstalls with KEEP_DATA
- add the missing mock-server.ts used by npm run dev:mock

awg-ui/src/App.css

@@ -24,6 +24,7 @@ html, body, #root { height: 100%; }
     --success-bg:   #c0dd97; --success-text: #2c4d0a; --success-dot: #639922;
     --neutral-bg:   #e4dac9; --neutral-text: #7a6a55; --neutral-dot:  #a99a85;
     --error-bg:     #ffdad6; --error-text:   #410002; --error-dot:    #ba1a1a;
+    --warn-dot:     #e08a2c;
 
     --danger-border: #e6c4bc;
     --danger-text:   #b34a3a;
@@ -65,6 +66,7 @@ html, body, #root { height: 100%; }
     --success-bg:   #2d4413; --success-text: #c8e3a0; --success-dot: #8fc24f;
     --neutral-bg:   #34291c; --neutral-text: #d0c0a4; --neutral-dot:  #b0a085;
     --error-bg:     #5c1414; --error-text:   #ffb4ab; --error-dot:    #ff5449;
+    --warn-dot:     #ffb76b;
 
     --danger-border: #6e4540;
     --danger-text:   #ffb4ab;