feat(pia): add PIA login-and-add WireGuard outbounds (#6272)

* feat(pia): add login-and-add WireGuard outbounds (#2)

* fix(pia): keep PIA outbounds identifiable after the editor strips hostname

The outbound editor drops piaHostname, so last-segment matching failed for hyphenated servers. Identify rows by the computed tag, re-encrypt stored tokens onto the active key, skip unusable catalog rows, and always release the catalog refresh latch.

frontend/src/test/outbounds-loopback-index.test.tsx

@@ -39,6 +39,7 @@ describe('OutboundsTab hidden-loopback index mapping', () => {
           onTestAll={vi.fn()}
           onShowWarp={vi.fn()}
           onShowNord={vi.fn()}
+          onShowPia={vi.fn()}
         />
       </QueryClientProvider>,
     );
@@ -77,6 +78,7 @@ describe('OutboundsTab hidden-loopback index mapping', () => {
           onTestAll={vi.fn()}
           onShowWarp={vi.fn()}
           onShowNord={vi.fn()}
+          onShowPia={vi.fn()}
         />
       </QueryClientProvider>,
     );