Add WireGuard support to VPN manager, use nm-applet for auth

nm-applet replaces the foot terminal workaround for VPN authentication,
providing a proper NetworkManager secret agent. moonarch-vpn now handles
both VPN and WireGuard connection types. Waybar indicator switched from
tun0 interface check to nmcli active connection query with signal-based
instant refresh.

defaults/xdg/niri/config.kdl

@@ -81,6 +81,7 @@ layout {
 spawn-at-startup "waybar"
 spawn-at-startup "dunst" "-conf" "/etc/xdg/dunst/dunstrc"
 spawn-at-startup "/usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1"
+spawn-at-startup "nm-applet" "--indicator"
 spawn-sh-at-startup "waypaper --restore"
 // spawn-sh-at-startup "nemo . &> /dev/null &"
 spawn-sh-at-startup "foot --server"