feat(wireguard): add WireGuard VPN role

Replace inline wg-quick config in nix-book with a reusable role that
uses inline config instead of configFile, fixing the world-readable
/tmp key leak. Adds network-online.target dependency to prevent boot
failures from DNS not being ready.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

roles/default.nix

@@ -19,6 +19,7 @@ with lib;
     ./spotifyd
     ./users
     ./virtualisation
+    ./wireguard
   ];
 
   config = {