fix(vpn): validate WireGuard keys before persistence (#541)

[thedancingdeveloper]

Summary

• require canonical 32-byte WireGuard key material
• reject malformed peer public and preshared keys before database writes
• verify a tunnel public key matches its private key before persistence
• add common and core regression coverage for invalid keys and mismatched pairs

Closes ZerosAndOnesLLC#541

Validation

• cargo fmt --all -- --check
• cargo clippy -p aifw-common -p aifw-core --all-targets -- -D warnings
• cargo test -p aifw-common -p aifw-core (367 unit tests plus integration tests passed)