[client] Adapt WGWatcher to per-instance model after #6664 rebase

The rebase carried #6664's WGWatcher changes into our wg_watcher package
(single-shot, no enabled flag). Adapt conn.go to match: create a fresh
watcher per connection attempt in enableWgWatcherIfNeeded, drop it in
disableWgWatcherIfNeeded, nil-guard resetEndpoint.

Guard stale WG timeouts on the event loop instead of #6664's conn.mu
recheck: onWGDisconnected only checked watcherCtx on the watcher
goroutine, racing the loop that cancels it and processes the timeout. A
loop-owned wgWatcherGen tags evWGTimeout; handleWGTimeout drops events
from a superseded generation, so the check and the teardown happen
atomically on the single loop.

client/internal/peer/event.go

@@ -54,7 +54,9 @@ type evRelayDown struct{}
 // successfully or not, so the loop may dispatch a pending offer.
 type evRelayDialDone struct{}
 
-type evWGTimeout struct{}
+type evWGTimeout struct {
+	gen uint64
+}
 
 // evWGHandshake reports the first WireGuard handshake of the current watcher run.
 type evWGHandshake struct {