Give WireGuard an explicit, admin-configurable subnet field

WireGuard previously had no configurable subnet at all -- only an
implicit one, either inferred from existing clients' own addresses
(wireguardAllocationBase) or a hardcoded 10.0.0.0/24 fallback when
none exist yet. AmneziaWG, by contrast, has always had a real
server.subnetIp/subnetCidr field in its settings, editable in the
UI. User request: give WireGuard the same treatment.

Backend: explicitWireguardSubnetBase reads an optional subnetIp/
subnetCidr pair from the inbound's own settings JSON (mirroring
AmneziaWG's defaultAmneziaWGSubnetBases). defaultWireguardClients
checks it first; only when unset does it fall back to today's
inference-from-existing-clients behavior, so an inbound saved before
this field existed keeps working exactly as it always has.

Frontend: subnetIp/subnetCidr added to WireguardInboundSettingsSchema
and the inbound form (mirroring AmneziaWG's own field layout/labels),
with a real default (10.0.0.0/24, the same value the backend already
fell back to) seeded for newly created inbounds so the field starts
populated and editable rather than blank. Translated across all 13
locales.

This also structurally closes the class of bug fixed in
82cc69f5/291c47b3: with wg and awg subnets explicit and
independently controllable, an admin who wants matching addresses
across both protocols can configure them to actually agree, instead
of one silently inheriting the other's incompatible range.

internal/web/translation/ar-EG.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "المفتاح السري",
         "publicKey": "المفتاح العام",
+        "subnetIp": "الشبكة الفرعية",
+        "subnetCidr": "بادئة الشبكة الفرعية (CIDR)",
         "allowedIPs": "عناوين IP المسموح بها",
         "endpoint": "النهاية",
         "domainStrategy": "استراتيجية الدومين"

internal/web/translation/en-US.json

@@ -1752,6 +1752,8 @@
       "wireguard": {
         "secretKey": "Secret Key",
         "publicKey": "Public Key",
+        "subnetIp": "Subnet",
+        "subnetCidr": "Subnet CIDR",
         "allowedIPs": "Allowed IPs",
         "endpoint": "Endpoint",
         "domainStrategy": "Domain Strategy"

internal/web/translation/es-ES.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "Llave secreta",
         "publicKey": "Llave pública",
+        "subnetIp": "Subred",
+        "subnetCidr": "CIDR de la subred",
         "allowedIPs": "IP permitidas",
         "endpoint": "Punto final",
         "domainStrategy": "Estrategia de dominio"

internal/web/translation/fa-IR.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "کلید شخصی",
         "publicKey": "کلید عمومی",
+        "subnetIp": "زیرشبکه",
+        "subnetCidr": "پیشوند زیرشبکه (CIDR)",
         "allowedIPs": "آی‌پی‌های مجاز",
         "endpoint": "نقطه پایانی",
         "domainStrategy": "استراتژی حل دامنه"

internal/web/translation/id-ID.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "Kunci Rahasia",
         "publicKey": "Kunci Publik",
+        "subnetIp": "Subnet",
+        "subnetCidr": "CIDR Subnet",
         "allowedIPs": "IP yang Diizinkan",
         "endpoint": "Titik Akhir",
         "domainStrategy": "Strategi Domain"

internal/web/translation/ja-JP.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "シークレットキー",
         "publicKey": "公開鍵",
+        "subnetIp": "サブネット",
+        "subnetCidr": "サブネットCIDR",
         "allowedIPs": "許可されたIP",
         "endpoint": "エンドポイント",
         "domainStrategy": "ドメイン戦略"

internal/web/translation/pt-BR.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "Chave Secreta",
         "publicKey": "Chave Pública",
+        "subnetIp": "Sub-rede",
+        "subnetCidr": "CIDR da Sub-rede",
         "allowedIPs": "IPs Permitidos",
         "endpoint": "Ponto Final",
         "domainStrategy": "Estratégia de Domínio"

internal/web/translation/ru-RU.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "Секретный ключ",
         "publicKey": "Публичный ключ",
+        "subnetIp": "Подсеть",
+        "subnetCidr": "Маска подсети (CIDR)",
         "allowedIPs": "Разрешенные IP-адреса",
         "endpoint": "Конечная точка",
         "domainStrategy": "Стратегия домена"

internal/web/translation/tr-TR.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "Gizli Anahtar",
         "publicKey": "Genel Anahtar",
+        "subnetIp": "Alt Ağ",
+        "subnetCidr": "Alt Ağ CIDR",
         "allowedIPs": "İzin Verilen IP'ler",
         "endpoint": "Uç Nokta",
         "domainStrategy": "Alan Adı Stratejisi"

internal/web/translation/uk-UA.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "Приватний ключ",
         "publicKey": "Публічний ключ",
+        "subnetIp": "Підмережа",
+        "subnetCidr": "CIDR підмережі",
         "allowedIPs": "Дозволені IP-адреси",
         "endpoint": "Кінцева точка",
         "domainStrategy": "Стратегія домену"

internal/web/translation/vi-VN.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "Khoá bí mật",
         "publicKey": "Khóa công khai",
+        "subnetIp": "Mạng con",
+        "subnetCidr": "CIDR mạng con",
         "allowedIPs": "IP được phép",
         "endpoint": "Điểm cuối",
         "domainStrategy": "Chiến lược tên miền"

internal/web/translation/zh-CN.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "密钥",
         "publicKey": "公钥",
+        "subnetIp": "子网",
+        "subnetCidr": "子网 CIDR",
         "allowedIPs": "允许的 IP",
         "endpoint": "端点",
         "domainStrategy": "域策略"

internal/web/translation/zh-TW.json

@@ -1635,6 +1635,8 @@
       "wireguard": {
         "secretKey": "金鑰",
         "publicKey": "公鑰",
+        "subnetIp": "子網路",
+        "subnetCidr": "子網路 CIDR",
         "allowedIPs": "允許的 IP",
         "endpoint": "端點",
         "domainStrategy": "域策略"