fix(pia): complete native WireGuard reconnect handling

[m4r1k]

Type

Please tick which one the following applies to your pull request:

• it is AI generated 🤖 and I did review it 👨👩
• it is humanly written like the good old days 👨‍🎨👩‍🎨
• it is AI generated 🤖 I did not review it 💤

Description

This is a follow-up review branch for passteque#3393. It targets neilcorp2kx:feat/pia-wireguard-native, not upstream master.

The branch first synchronizes passteque#3393 with current upstream master, then addresses the review and live-test failures reported on the original PR:

• replace the custom SO_MARK bootstrap firewall implementation with the merged internal/restrictednet source-port-scoped DoH and HTTPS path
• make server-list lookup, token retrieval, and addKey registration independent of tunnel DNS during reconnects
• fix port forwarding shutdown so clearing runtime connection state does not fail validation before the keepalive service stops
• cycle through every matching live PIA WireGuard server instead of repeatedly selecting the first endpoint
• try the addKey server_vip directly for port forwarding before the existing OpenVPN-derived gateway fallbacks
• reject user-supplied private keys, pre-shared keys, and interface addresses for PIA's dynamically registered connection
• disable IPv6 routes for PIA's IPv4-only WireGuard registration
• keep the PIA feature scoped by removing the unrelated global healthcheck startup retry change
• repair the stale-branch test syntax, Go 1.26 compatibility, formatting, and current lint issues

The persisted PIA port-forward payload intentionally remains server-independent. PIA documents payload and signature reuse across servers, and the live reconnect test below successfully rebound the same port after switching endpoints.

Verification

Repository checks:

• docker build --no-cache --target lint .
• docker build --target mocks .
• docker build --target xcompile .
• focused go test -race across settings, firewall, restrictednet, PIA provider/updater, provider utilities, port forwarding, VPN, and healthcheck packages
• go test -tags=integration ./internal/restrictednet
• final application image build

Authenticated PIA test against CA Vancouver with the firewall and port forwarding enabled:

• established a kernelspace WireGuard tunnel and confirmed PIA public egress
• obtained a forwarded TCP port and reached it from a separate container
• inspected iptables OUTPUT after bootstrap; only the active WireGuard endpoint and tunnel rules remained
• deleted tun0 to reproduce the reported health failure
• observed port forwarding stop cleanly and remove its firewall rule, without server name not set
• automatically fetched a fresh server list and addKey registration through restrictednet
• connected to a different Vancouver endpoint and restored public egress
• rebound the same saved forwarded port and reached it externally again
• stopped cleanly, removed the allowed input port, and cleared the forwarded-port file

Traditional PIA OpenVPN regression against CA Vancouver with the same image:

• completed the normal OpenVPN initialization path and established tun0
• confirmed PIA public egress
• obtained a PIA forwarded TCP port and reached it from a separate container
• inspected iptables OUTPUT; only the OpenVPN endpoint and tunnel rules were present

The default full test-container run still reports the same internal/netlink and internal/pmtud/tcp failures as current upstream master on the test host. SELinux audit records show container_t being denied module_request for rtnl-link-wireguard and ipt_mark; these are host-policy failures, not branch-only failures. The authenticated tunnel test was run during a user-controlled temporary permissive window.

AI was used for code analysis and code generation. I reviewed the resulting changes, tests, and live verification output before proposing them.

Issue (optional)

Follow-up fixes for passteque#3393.

Gluetun wiki associated pull request (optional)

None.