rotate egress over a larger WG pool, with graceful drain and live status

Keep the N always-on tunnel slots fixed but let each slot's WireGuard config
rotate through a larger pool, so a 10-concurrent provider cap (e.g. Proton) can
still cycle 50-100 profiles.

- lxc/rotate.sh + weircon-rotate.{service,timer}: round-robin one slot at a
  time through wg-pool/, repointing a symlink and restarting only that slot.
- service: proxyManager tracks per-slot in-flight + drain/undrain state; a
  localhost admin server (WEIRCON_ADMIN_LISTEN) lets rotate.sh drain a slot
  before teardown and warm it back in after, so no request is routed to a
  tunnel mid-rotation. Slots self-heal if undrain never arrives.
- GET /status: poll-friendly JSON of per-slot egress IP/state plus inferred
  next-rotation slot + ETA, fed by a background egress-IP prober.
- docs + env examples for all new knobs.

lxc/setup-container.sh

@@ -54,18 +54,26 @@ chmod +x "$BIN"
 # 4. Helper-scripts
 install -Dm755 "$SCRIPT_DIR/netns-up.sh"   /usr/local/sbin/weircon-netns-up
 install -Dm755 "$SCRIPT_DIR/netns-down.sh" /usr/local/sbin/weircon-netns-down
+install -Dm755 "$SCRIPT_DIR/rotate.sh"     /usr/local/sbin/weircon-rotate
 
 # 5. systemd units
 install -Dm644 "$SCRIPT_DIR/weircon-proxies.target"   /etc/systemd/system/weircon-proxies.target
 install -Dm644 "$SCRIPT_DIR/weircon-proxy@.service"   /etc/systemd/system/weircon-proxy@.service
 install -Dm644 "$SCRIPT_DIR/weircon-fetch.service"    /etc/systemd/system/weircon-fetch.service
+install -Dm644 "$SCRIPT_DIR/weircon-rotate.service"   /etc/systemd/system/weircon-rotate.service
+install -Dm644 "$SCRIPT_DIR/weircon-rotate.timer"     /etc/systemd/system/weircon-rotate.timer
 
 # 6. Config-dir + default env
-mkdir -p /etc/weircon-random-proxy/wg
-chmod 700 /etc/weircon-random-proxy/wg
+#    wg/      = aktive slot-configs (proxy0.conf..proxyN.conf, evt. symlinks)
+#    wg-pool/ = valgfri pulje af ekstra configs som rotationen cykler igennem
+mkdir -p /etc/weircon-random-proxy/wg /etc/weircon-random-proxy/wg-pool
+chmod 700 /etc/weircon-random-proxy/wg /etc/weircon-random-proxy/wg-pool
 if [[ ! -f /etc/weircon-random-proxy/fetch.env ]]; then
     install -m640 "$SCRIPT_DIR/fetch.env.example" /etc/weircon-random-proxy/fetch.env
 fi
+if [[ ! -f /etc/weircon-random-proxy/rotate.env ]]; then
+    install -m640 "$SCRIPT_DIR/rotate.env.example" /etc/weircon-random-proxy/rotate.env
+fi
 
 systemctl daemon-reload
 
@@ -89,6 +97,16 @@ Start stakken:
   systemctl enable --now weircon-proxy@{0..9}.service
   systemctl enable --now weircon-fetch.service
 
+(Valgfrit) Roter over en STØRRE pulje af configs end de 10 slots:
+  # læg fx 50-100 configs i puljen
+  cp proton-*.conf /etc/weircon-random-proxy/wg-pool/
+  # seed de 10 aktive slots som symlinks ind i puljen
+  weircon-rotate init
+  systemctl restart weircon-proxy@{0..9}.service
+  # roter automatisk én slot ad gangen (interval i weircon-rotate.timer)
+  systemctl enable --now weircon-rotate.timer
+  # juster intervallet: systemctl edit weircon-rotate.timer  (default 5min)
+
 Verificér:
   systemctl status 'weircon-proxy@*'
   curl http://127.0.0.1:8080/health