Add AWG_GEN/AWG_PIN switches and surface module version

Upstream AmneziaWG 3.x is still shifting under active development
(unanswered kernel-module issues around header protection and
handshake-without-data regressions), so give operators an explicit
opt-out/opt-in instead of always auto-selecting 3.1, and pin the
installed package so unattended-upgrades can't swap the module under
a live server. Surface the running module/tools version and protocol
generation through /health, the CLI status command, and the panel's
server card so a mismatch is visible instead of silent.

awg-ui/src/App.css

@@ -406,6 +406,13 @@ body {
     color: var(--neutral-text);
     line-height: 1.2;
 }
+.server-gen-wrap { align-self: flex-start; margin-top: 2px; }
+.server-gen-chip {
+    align-self: flex-start;
+    margin-top: 2px;
+    font-size: 11px;
+    padding: 2px 8px;
+}
 .server-card-peers {
     font-size: 12px;
     color: var(--neutral-text);