Record WireGuard tunnel recovery

[tdenisenko]

Summary

Documents the July 18 Mac mini outage investigation and recovery.

What changed

• Recorded that LogEx itself did not crash; the tmux session and process stayed alive while the dashboard was unreachable.
• Documented the root cause as a stale WireGuard full-VPS tunnel: routes and NAT rules remained present, but the tunnel stopped handshaking and the VPS could not reach 10.66.0.2.
• Recorded that full VPS routing was repaired, the dashboard became publicly reachable again at http://157.245.195.72:18683/, and LogEx was gracefully restarted after storage integrity verification.
• Noted the operational design decision that the WireGuard watchdog must probe actual tunnel traffic, not only interface or route presence.
• Preserved the known limitation that local-ops/ scripts are machine-specific and intentionally ignored by Git unless explicitly force-added later.

Validation

• sh -n local-ops/logex-full-vps-routing.sh
• sh -n local-ops/logex-dashboard-only-routing.sh
• git diff --check
• Verified the installed Mac LaunchDaemon contains the tunnel probe/rebuild path.
• Verified public /status via http://157.245.195.72:18683/ after recovery.

Notes

The operational script updates were installed on the Mac mini but are not part of this PR because local-ops/ is intentionally ignored and contains machine-specific routing details.