fix(wireguard): step over wide address claims when allocating

allocateWireguardAddress walked the scope one address at a time and
tested each against every wide claim, so a claim covering an IPv6 /64
(a node can report such allowedIPs) turned the next address-less client
add into a 2^64-step loop that also held every later client change on
that inbound. The scan now jumps past a wide claim in one step, so it is
bounded by the number of claims.

internal/web/service/client_wireguard_test.go

@@ -24,6 +24,9 @@ func TestAllocateWireguardAddress(t *testing.T) {
 		{name: "default base when empty", used: nil, base: "", want: "10.0.0.2/32"},
 		{name: "full ipv4 scope widens instead of failing", used: []string{"10.9.0.2/32", "10.9.0.3/32"}, base: "10.9.0.0/30", want: "10.9.0.4/32"},
 		{name: "exhausted ipv6 scope errors", used: []string{"fd00::2/128", "fd00::3/128"}, base: "fd00::/126", err: true},
+		// A node can report a wide claim; the scan must step over it, not through 2^64 addresses.
+		{name: "wide claim over an ipv6 scope", used: []string{"fd00::/64"}, base: "fd00::/64", err: true},
+		{name: "first address past a wide claim", used: []string{"10.0.0.0/25"}, base: "10.0.0.0/24", want: "10.0.0.128/32"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {