Add WireGuard support to VPN manager, use nm-applet for auth

nm-applet replaces the foot terminal workaround for VPN authentication,
providing a proper NetworkManager secret agent. moonarch-vpn now handles
both VPN and WireGuard connection types. Waybar indicator switched from
tun0 interface check to nmcli active connection query with signal-based
instant refresh.

defaults/xdg/waybar/config

@@ -367,9 +367,10 @@
     "custom/vpn": {
         "format": "󰖂",
         "exec": "echo '{\"class\": \"connected\", \"tooltip\": \"VPN Connected\"}'",
-        "exec-if": "test -d /proc/sys/net/ipv4/conf/tun0",
+        "exec-if": "nmcli -t -f TYPE,STATE connection show --active | grep -qE '^(vpn|wireguard):'",
         "return-type": "json",
-        "interval": 5
+        "interval": 5,
+        "signal": 9
     },
     "power-profiles-daemon": {
         "format": "{icon}",