hivectl: wireguard mesh setup verbs (#1756)

One-time-setup convenience for the inter-hive WireGuard mesh
(services.hyperhive.swarm) so nobody has to remember the wg dance:

- hivectl wg init [--address X] — generate (if absent) the hive's
  private key at /etc/wireguard/hive.key (0400, never clobbered),
  derive + print the public key, and print the swarm.wireguard nix
  snippet to enable the mesh.
- hivectl wg peer <domain> --pubkey --address [--endpoint] — print the
  swarm.peers.<domain> nix snippet to add a remote hive.
- hivectl wg status — wrap wg show wg-hive.

Hybrid model per the design: the verb owns the imperative state (the
key file), the operator pastes the printed nix into host config (kept
in git) — nothing mutates declarative config behind their back.
hivectl-only (root host ops, like the gateway htpasswd verbs); no
priv/wire/c0re changes.

flake: wrap hivectl with wireguard-tools on PATH so wg resolves even
before the mesh config (which would otherwise pull it in) exists —
wg init is the first setup step. Add clippy.toml doc-valid-idents for
the WireGuard proper noun. Regenerate hivectl-cli.md.

clippy.toml

@@ -0,0 +1,4 @@
+# Proper nouns / product names that clippy's `doc_markdown` lint would
+# otherwise flag as un-backticked identifiers in doc-comments. `".."`
+# keeps clippy's built-in default list (GitHub, OAuth, …) and extends it.
+doc-valid-idents = ["WireGuard", ".."]