wireguard: refresh FQDN peer endpoints on handshake retry

[tinymins]

WireGuard peer endpoint domains are currently resolved only during startup. When a DDNS record changes, the device keeps sending handshakes to the stale address until sing-box is restarted.

This change listens for wireguard-go handshake retry events and then:

• performs a fresh DNS lookup with the configured resolver and cache disabled;
• updates changed peer endpoints in place through minimal UAPI update_only commands;
• coalesces concurrent events and limits refreshes to one every 10 seconds;
• keeps literal-IP peers and healthy/idle tunnels unchanged.

FQDN peers no longer use the fixed-remote connected bind optimization, so an updated address takes effect without recreating the WireGuard device or TUN.

This supersedes the approach in #3486: refreshes are driven by actual WireGuard handshake failure rather than generic connection errors, and cached DNS answers are explicitly bypassed.

Tests:

• go test -race ./transport/wireguard ./protocol/wireguard
• go test -tags "$(cat release/DEFAULT_BUILD_TAGS_OTHERS)" -ldflags "$(cat release/LDFLAGS)" ./...
• Windows amd64 build with release/DEFAULT_BUILD_TAGS_WINDOWS
• Windows sing-box check against the production configuration