Add AmneziaWG mode (wireproxy-awg userspace SOCKS)

Third mode alongside proxy and VLESS+Reality. Bundles wireproxy-awg built
from a pinned, audited source commit (fork of wireproxy over the official
amneziawg-go), exposing a local SOCKS5 tunnel with no TUN/driver/admin.
User picks their AmneziaWG .conf; the app appends a [Socks5] section and
routes Claude through it with the same fail-closed firewall.

build-wireproxy.ps1 reproducibly builds the binary (portable Go + pinned
commit); it is embedded as a resource and not stored in git.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -5,6 +5,9 @@
 xray.zip
 xray-embed.b64
 
+# wireproxy-awg binary (built from pinned source by build-wireproxy.ps1) - not stored in git
+wireproxy-awg.exe
+
 # preview / debug artifacts
 *-preview.png
 preview.png