[client] pqkem: take the netstack type from wgbackend

Main now imports the wireguard-go fork directly instead of through a
replace directive, so the upstream netstack path resolves to the original
module, which no longer builds against the bumped gvisor.

client/internal/pqkem_transport.go

@@ -7,7 +7,8 @@ import (
 	"sync"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // DefaultPort is the preferred UDP port for the ML-KEM data-path service, bound on
@@ -34,7 +35,7 @@ type pqTransport struct {
 // clients): the overlay IP then exists only inside that userspace stack, so the socket
 // is opened there and its datagrams ride the tunnel like any other overlay traffic. A
 // nil ns binds on the host.
-func newPQTransport(overlayIP netip.Addr, ns *netstack.Net) (*pqTransport, error) {
+func newPQTransport(overlayIP netip.Addr, ns *wgbackend.NetstackNet) (*pqTransport, error) {
 	if !overlayIP.IsValid() {
 		return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
 	}

client/internal/pqkem_transport_test.go

@@ -7,7 +7,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type pqInbound struct {
@@ -68,7 +69,7 @@ func TestPQTransport_HostRoundTrip(t *testing.T) {
 // starting); the transport must open its socket on the netstack instead.
 func TestPQTransport_NetstackRoundTrip(t *testing.T) {
 	overlay := netip.MustParseAddr("192.0.2.1")
-	dev, ns, err := netstack.CreateNetTUN([]netip.Addr{overlay}, nil, 1280)
+	dev, ns, err := wgbackend.CreateNetTUN([]netip.Addr{overlay}, nil, 1280)
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = dev.Close() })