Add WireGuard support to VPN manager, use nm-applet for auth

nm-applet replaces the foot terminal workaround for VPN authentication,
providing a proper NetworkManager secret agent. moonarch-vpn now handles
both VPN and WireGuard connection types. Waybar indicator switched from
tun0 interface check to nmcli active connection query with signal-based
instant refresh.

defaults/xdg/niri/config.kdl

@@ -81,6 +81,7 @@ layout {
 spawn-at-startup "waybar"
 spawn-at-startup "dunst" "-conf" "/etc/xdg/dunst/dunstrc"
 spawn-at-startup "/usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1"
+spawn-at-startup "nm-applet" "--indicator"
 spawn-sh-at-startup "waypaper --restore"
 // spawn-sh-at-startup "nemo . &> /dev/null &"
 spawn-sh-at-startup "foot --server"

defaults/xdg/waybar/config

@@ -367,9 +367,10 @@
     "custom/vpn": {
         "format": "󰖂",
         "exec": "echo '{\"class\": \"connected\", \"tooltip\": \"VPN Connected\"}'",
-        "exec-if": "test -d /proc/sys/net/ipv4/conf/tun0",
+        "exec-if": "nmcli -t -f TYPE,STATE connection show --active | grep -qE '^(vpn|wireguard):'",
         "return-type": "json",
-        "interval": 5
+        "interval": 5,
+        "signal": 9
     },
     "power-profiles-daemon": {
         "format": "{icon}",