hivectl: wireguard mesh setup verbs (#1756)

One-time-setup convenience for the inter-hive WireGuard mesh
(services.hyperhive.swarm) so nobody has to remember the wg dance:

- hivectl wg init [--address X] — generate (if absent) the hive's
  private key at /etc/wireguard/hive.key (0400, never clobbered),
  derive + print the public key, and print the swarm.wireguard nix
  snippet to enable the mesh.
- hivectl wg peer <domain> --pubkey --address [--endpoint] — print the
  swarm.peers.<domain> nix snippet to add a remote hive.
- hivectl wg status — wrap wg show wg-hive.

Hybrid model per the design: the verb owns the imperative state (the
key file), the operator pastes the printed nix into host config (kept
in git) — nothing mutates declarative config behind their back.
hivectl-only (root host ops, like the gateway htpasswd verbs); no
priv/wire/c0re changes.

flake: wrap hivectl with wireguard-tools on PATH so wg resolves even
before the mesh config (which would otherwise pull it in) exists —
wg init is the first setup step. Add clippy.toml doc-valid-idents for
the WireGuard proper noun. Regenerate hivectl-cli.md.

flake.nix

@@ -164,10 +164,14 @@
           default = craneLib.buildPackage {
             src = cleanSrc;
             inherit cargoArtifacts;
-            # `installShellFiles` provides `installShellCompletion` for the
-            # postInstall below; appended (not in the shared set) so it's a
-            # build input only of this binary derivation.
-            nativeBuildInputs = nativeBuildInputs ++ [ pkgs.installShellFiles ];
+            # `installShellFiles` provides `installShellCompletion` and
+            # `makeWrapper` provides `wrapProgram` for the postInstall below;
+            # appended (not in the shared set) so they're build inputs only of
+            # this binary derivation.
+            nativeBuildInputs = nativeBuildInputs ++ [
+              pkgs.installShellFiles
+              pkgs.makeWrapper
+            ];
             pname = "hyperhive-workspace";
             version = "0.1.0";
             meta.description = "hyperhive workspace (hive-c0re, hive-ag3nt, hive-root)";
@@ -178,11 +182,20 @@
             # `$out/share/{zsh/site-functions,bash-completion,fish}/…`; an
             # operator gets working completion as soon as hivectl is in their
             # system/user profile with the shell's completion enabled.
+            #
+            # Then wrap hivectl with `wireguard-tools` on PATH so its `wg`
+            # subcommands (`wg init`/`peer`/`status`) work even before the
+            # WireGuard mesh is configured — `wg init` is the *first* setup
+            # step, run before `swarm.wireguard.enable` (which would otherwise
+            # be what pulls wireguard-tools onto the system). Completion
+            # generation runs first since wrapProgram renames the real binary.
             postInstall = ''
               installShellCompletion --cmd hivectl \
                 --bash <("$out/bin/hivectl" completions bash) \
                 --zsh <("$out/bin/hivectl" completions zsh) \
                 --fish <("$out/bin/hivectl" completions fish)
+              wrapProgram "$out/bin/hivectl" \
+                --prefix PATH : ${pkgs.wireguard-tools}/bin
             '';
           };
           # Bundled browser assets — see ./nix/frontend.nix. Output is