feat(mesh): add heather WireGuard backbone peer

hosts/heather/default.nix

@@ -23,6 +23,38 @@
     ./pi-web.nix          # pi-web (web UI для pi coding agent, systemd + npm global)
   ];
 
+  # First server-to-server WireGuard backbone link: heather ↔ hyacinth.
+  # The private key is generated on the live host and stays outside the flake.
+  environment.systemPackages = [ pkgs.wireguard-tools ];
+
+  systemd.network.netdevs."10-mesh0" = {
+    netdevConfig = { Name = "mesh0"; Kind = "dummy"; };
+  };
+  networking.interfaces.mesh0.ipv4.addresses = [ { address = "10.0.0.1"; prefixLength = 32; } ];
+
+  networking.wireguard.interfaces.wg-mesh = {
+    ips = [ "10.99.0.1/30" ];
+    listenPort = 51820;
+    privateKeyFile = "/var/lib/wireguard/wg-mesh.key";
+    # Keep WG as transport/crypto ACL; install the identity route explicitly below.
+    allowedIPsAsRoutes = false;
+    peers = [
+      {
+        publicKey = "v51g02IEjLyu7gqjjznN/UtU8Te5imZzy64/+BF/dn4=";
+        allowedIPs = [ "10.99.0.2/32" "10.0.0.2/32" ];
+        endpoint = "195.242.119.59:51820";
+        persistentKeepalive = 25;
+      }
+    ];
+  };
+
+  networking.interfaces.wg-mesh.ipv4.routes = [
+    { address = "10.0.0.2"; prefixLength = 32; }
+  ];
+
+  # Needed later when this node becomes a transit/exit peer.
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
   # Arion-проект как systemd-сервис: arion-compose.nix → docker-compose → up.
   # NB: settings — это модуль с imports, НЕ `import ./arion-compose.nix`.
   virtualisation.arion.backend = "docker";
@@ -47,8 +79,10 @@
       22070   # strelaysrv (status)
       3478    # coturn TURN (tcp+udp)
       8443    # xray VLESS+Reality (публичный прокси)
+      51820   # WireGuard mesh backbone
     ];
     firewall.allowedUDPPorts = [
+      51820   # WireGuard mesh backbone
       22000   # syncthing sync (QUIC)
       10000   # jitsi jvb (RTP media)
       3478    # coturn TURN