Refactor installer and add Docker E2E matrix

[angristan]

Summary

• refactor the WireGuard installer around structured logging, CLI subcommands, non-interactive install flags, and expanded distro support
• add fast local shell tests plus CI coverage for them
• add Docker E2E tests with a broad distro matrix, nftables coverage, and dual-stack tunnel validation

Testing

• bash test/run-tests.sh
• bash test/e2e/run-docker-e2e.sh
• CLIENT_IPV6=y bash test/e2e/run-docker-e2e.sh
• ENABLE_NFTABLES=y SERVER_BASE_IMAGE=debian:12 bash test/e2e/run-docker-e2e.sh
• bash -n wireguard-install.sh test/run-tests.sh test/e2e/*.sh
• shfmt -d wireguard-install.sh test/run-tests.sh test/e2e/*.sh
• shellcheck -e SC1091,SC1117,SC2001,SC2034 wireguard-install.sh test/run-tests.sh test/e2e/*.sh
• git diff --check