rotate egress over a larger WG pool, with graceful drain and live status

Keep the N always-on tunnel slots fixed but let each slot's WireGuard config
rotate through a larger pool, so a 10-concurrent provider cap (e.g. Proton) can
still cycle 50-100 profiles.

- lxc/rotate.sh + weircon-rotate.{service,timer}: round-robin one slot at a
  time through wg-pool/, repointing a symlink and restarting only that slot.
- service: proxyManager tracks per-slot in-flight + drain/undrain state; a
  localhost admin server (WEIRCON_ADMIN_LISTEN) lets rotate.sh drain a slot
  before teardown and warm it back in after, so no request is routed to a
  tunnel mid-rotation. Slots self-heal if undrain never arrives.
- GET /status: poll-friendly JSON of per-slot egress IP/state plus inferred
  next-rotation slot + ETA, fed by a background egress-IP prober.
- docs + env examples for all new knobs.

lxc/systemd/weircon-rotate.timer

@@ -0,0 +1,21 @@
+[Unit]
+Description=weircon-random-proxy: periodisk slot-rotation
+PartOf=weircon-proxies.target
+
+[Timer]
+# Standard: roter én slot hvert 5. minut. Med 10 slots betyder det at hele
+# slot-sættet er cyklet igennem ca. hvert 50. minut, og hver enkelt config i
+# en pulje på N filer er brugt mindst én gang efter ca. (N * 5) minutter.
+#
+# Skift interval uden at redigere denne fil:
+#   systemctl edit weircon-rotate.timer
+# og indsæt fx:
+#   [Timer]
+#   OnUnitActiveSec=   # (tom linje nulstiller arvet værdi)
+#   OnUnitActiveSec=15min
+OnBootSec=5min
+OnUnitActiveSec=5min
+AccuracySec=15s
+
+[Install]
+WantedBy=timers.target