build 22

Validate WireGuard keys in the UI layer with clear error messages.

Fixes issue #3 — "failed to set private_key: hex string does not fit the slice".

Before this commit the hexKey() helper in TunnelManager.swift silently returned an empty string whenever Swift's Data(base64Encoded:) refused the input (common causes: leading/trailing whitespace, missing = padding, URL-safe Base64 alphabet -_ instead of +/). That empty string made it into the UAPI config as private_key=, which wireguard-go tried to hex-decode into a 32-byte slice and produced the baffling "failed to set private_key: hex string does not fit the slice" error.

Fix:

• New KeyError (LocalizedError) with distinct messages for empty input, invalid Base64, and wrong decoded length.
• parseWireGuardKey() is now tolerant of common paste artifacts: trims whitespace/newlines, normalizes URL-safe Base64 (-_ → +/), and ignores internal whitespace via .ignoreUnknownCharacters. Also explicitly enforces the 32-byte length.
• buildUAPIConfig() is now throws; connect()'s existing do/catch surfaces the KeyError message via errorMessage, so the user sees e.g. "Private Key is not valid Base64. Expected 44 characters ending with '=' (output of wg genkey)." instead of wireguard-go's cryptic hex complaint.