- Activate wg interface explicitly if nmcli import does not do it automatically (Arch)
- Apply DNS via hydraveil-resolvectl wrapper instead of resolvectl directly (avoids polkit auth dialog)
- Add __is_resolved_active() helper to check systemd-resolved before applying DNS
- Wait for socket.getaddrinfo to confirm DNS is routable before await_connection()
- Replace subprocess test_connection with requests direct call + socket.getaddrinfo (respects systemd-resolved on all distros)
- Use sudo install instead of pkexec install for wg.conf copy (uses sudoers, more reliable)
- Add fallback to pkexec if sudo not available
