lib: remove the IPIP/ESP tunnel peer path

[shreyas-blacksmith]

Summary

Mac static-IP hosts now reach vprox through the TLS+yamux relay (#21). Nothing calls /connect-ipip any more, so this drops the whole kernel tunnel peer path: the handler, ipipPeer state under ipipMu, per-peer IPIP links + xfrm ESP SAs/policies, the housekeeping sweep, RestoreIpipFromKernel on startup, the IPIP MSS clamp rules, and docs/ESP_OPERATIONS.md.

flowchart LR
  subgraph before [Before]
    direction TB
    a1[Mac gif+IPsec] -->|/connect-ipip| a2[ipip link + xfrm SA] --> a3[NAT to static IP]
    b1[Linux wg] -->|/connect| b2[WireGuard peer] --> a3
  end
  subgraph after [After]
    direction TB
    c1[Mac egress proxy] -->|TLS+yamux relay :9443| c3[dial bound to static IP]
    d1[Linux wg] -->|/connect| d2[WireGuard peer] --> d3[NAT to static IP]
  end
  before ~~~ after

Loading

What stays: /connect + WireGuard peers, the iptables rules they need, and the relay. ServerManager.Start still leaves WireGuard and iptables in place across restarts; only the IPIP restore step is gone.

Companion: the fa Ansible setup_vprox_server.yaml still installs the proto-4/ESP accept rules from ipip_client_cidrs; those go with the fa proxy-only stack.

-3526 / +15 lines. go build ./... && go vet ./... && go test ./... green.

Link to Devin session: https://app.devin.ai/sessions/3732a5e335164324a71ec27bf19595aa
Open in Devin Desktop: https://app.devin.ai/desktop/session/3732a5e335164324a71ec27bf19595aa?variant=devin
Requested by: @shreyas-blacksmith

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled. (Staging)}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 92cf1b9. Configure here.}