Merge main into ui-refactor; port MDM support to the Wails UI

Integrates main's MDM configuration-profile feature and adapts it to the
Wails UI (this branch had already replaced the Fyne UI).

Conflict resolution:
- go.mod/go.sum: take main's deps; howett.net/plist pinned to v1.0.2-... (tidy)
- client/proto/daemon.pb.go: regenerated from the merged daemon.proto
- client/internal/peer/status.go: union of ipToKey (main) + sessionExpiresAt (HEAD)
- client/server/server.go: main's intent/liveness model (connectionGoroutineRunning,
  clientRunning no longer cleared by the goroutine) + empty-PSK guard
- client/ui/client_ui.go, client/ui/profile.go: removed (dead Fyne UI)

MDM port (backend + tray):
- services/settings.go: expose MDMManagedFields plus a managedFields map keyed
  by Config field names so the settings form can gate a control without
  translating mdm.Key* names
- tray: gate Profiles / Exit Node menus on DisableProfiles / DisableNetworks via
  GetFeatures, refreshed on the config_changed system event (replaces the legacy
  2s poll); localized MDM policy-applied toast in all shipped locales
- client/proto/metadata.go: shared constants for the config_changed /
  policy_applied event markers

PreSharedKey: GetConfig now returns preSharedKeySet (bool) instead of the masked
value; the settings form provides its own placeholder and sends a new key only
when the user types one.

client/ui/i18n/locales/de/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "Der Server hat eine ungültige Sitzungsablaufzeit übermittelt. Bitte melden Sie sich erneut an."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird-Einstellungen aktualisiert"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Ihre NetBird-Konfiguration wurde durch Ihre IT-Richtlinie aktualisiert."
+    },
     "common.cancel": {
         "message": "Abbrechen"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "Optionaler WireGuard-PSK für zusätzliche symmetrische Verschlüsselung. Nicht identisch mit einem NetBird Setup-Key. Sie kommunizieren nur mit Peers, die denselben Pre-shared Key verwenden."
     },
+    "settings.advanced.psk.configured": {
+        "message": "Ein Pre-shared Key ist gesetzt – geben Sie einen neuen ein, um ihn zu ersetzen."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Debug-Paket"
     },

client/ui/i18n/locales/en/common.json

@@ -223,6 +223,14 @@
         "message": "The server sent an invalid session deadline. Please sign in again.",
         "description": "Body explaining the server sent an invalid session deadline and the user must sign in again."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird settings updated",
+        "description": "Title of the desktop notification shown when an MDM (IT-managed) policy changed the daemon configuration at runtime."
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Your NetBird configuration was updated by your IT policy.",
+        "description": "Body of the MDM policy-applied notification, telling the user their settings were changed by their organization's device-management policy."
+    },
     "common.cancel": {
         "message": "Cancel",
         "description": "Generic Cancel button label, reused across dialogs. Keep short."
@@ -927,6 +935,10 @@
         "message": "Optional WireGuard PSK for extra symmetric encryption. Not the same as a NetBird Setup Key. You will only communicate with peers that use the same pre-shared key.",
         "description": "Helper text for the WireGuard PSK. 'WireGuard', 'PSK', and 'NetBird Setup Key' are product/technical terms — keep them."
     },
+    "settings.advanced.psk.configured": {
+        "message": "A pre-shared key is set — enter a new one to replace it.",
+        "description": "Placeholder shown in the empty PSK input when a pre-shared key is already configured; the field stays blank because the daemon never returns the value."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Debug bundle",
         "description": "Section heading: Debug bundle."

client/ui/i18n/locales/es/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "El servidor envió un plazo de sesión no válido. Inicie sesión de nuevo."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "Configuración de NetBird actualizada"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Su configuración de NetBird fue actualizada por su política de TI."
+    },
     "common.cancel": {
         "message": "Cancelar"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "PSK de WireGuard opcional para cifrado simétrico adicional. No es lo mismo que una clave de instalación de NetBird. Solo se comunicará con peers que usen la misma clave precompartida."
     },
+    "settings.advanced.psk.configured": {
+        "message": "Hay una clave precompartida configurada: introduzca una nueva para reemplazarla."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Paquete de diagnóstico"
     },

client/ui/i18n/locales/fr/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "Le serveur a envoyé une échéance de session invalide. Veuillez vous reconnecter."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "Paramètres NetBird mis à jour"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Votre configuration NetBird a été mise à jour par votre politique informatique."
+    },
     "common.cancel": {
         "message": "Annuler"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "PSK WireGuard facultative pour un chiffrement symétrique supplémentaire. Différente d’une clé d’installation NetBird. Vous ne communiquerez qu’avec les pairs utilisant la même clé pré-partagée."
     },
+    "settings.advanced.psk.configured": {
+        "message": "Une clé pré-partagée est définie — saisissez-en une nouvelle pour la remplacer."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Lot de diagnostic"
     },

client/ui/i18n/locales/hu/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "A szerver érvénytelen munkamenet-határidőt küldött. Kérjük, jelentkezzen be újra."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird beállítások frissítve"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A NetBird konfigurációt az IT-szabályzat frissítette."
+    },
     "common.cancel": {
         "message": "Mégse"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "Opcionális WireGuard PSK további szimmetrikus titkosításhoz. Nem azonos a NetBird telepítőkulccsal. Csak olyan Peerekkel kommunikál, akik ugyanazt a pre-shared kulcsot használják."
     },
+    "settings.advanced.psk.configured": {
+        "message": "Pre-shared kulcs be van állítva – új megadásával cserélhető."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Hibakeresési csomag"
     },

client/ui/i18n/locales/it/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "Il server ha inviato una scadenza di sessione non valida. Effettui di nuovo l'accesso."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "Impostazioni NetBird aggiornate"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "La configurazione di NetBird è stata aggiornata dalla policy IT."
+    },
     "common.cancel": {
         "message": "Annulla"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "PSK WireGuard opzionale per una crittografia simmetrica aggiuntiva. Non è la stessa cosa di una chiave di configurazione NetBird. Comunicherà solo con i peer che usano la stessa chiave pre-condivisa."
     },
+    "settings.advanced.psk.configured": {
+        "message": "Una chiave pre-condivisa è impostata: ne inserisca una nuova per sostituirla."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Pacchetto di debug"
     },

client/ui/i18n/locales/pt/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "O servidor enviou um prazo de sessão inválido. Faça login novamente."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "Definições do NetBird atualizadas"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A sua configuração do NetBird foi atualizada pela política de TI."
+    },
     "common.cancel": {
         "message": "Cancelar"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "PSK opcional do WireGuard para criptografia simétrica adicional. Não é o mesmo que uma chave de configuração do NetBird. Você só se comunicará com peers que usem a mesma chave pré-compartilhada."
     },
+    "settings.advanced.psk.configured": {
+        "message": "Uma chave pré-compartilhada está definida — introduza uma nova para a substituir."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Pacote de depuração"
     },

client/ui/i18n/locales/ru/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "Сервер передал неверный срок действия сеанса. Пожалуйста, войдите снова."
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "Настройки NetBird обновлены"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Конфигурация NetBird была обновлена в соответствии с вашей ИТ-политикой."
+    },
     "common.cancel": {
         "message": "Отмена"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "Необязательный PSK WireGuard для дополнительного симметричного шифрования. Это не то же самое, что ключ установки NetBird. Вы будете обмениваться данными только с пирами, использующими тот же общий ключ."
     },
+    "settings.advanced.psk.configured": {
+        "message": "Общий ключ установлен — введите новый, чтобы заменить его."
+    },
     "settings.troubleshooting.section.title": {
         "message": "Отладочный пакет"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -167,6 +167,12 @@
     "notify.sessionDeadlineRejected.body": {
         "message": "服务器发送了无效的会话截止时间。请重新登录。"
     },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird 设置已更新"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "您的 NetBird 配置已根据 IT 策略更新。"
+    },
     "common.cancel": {
         "message": "取消"
     },
@@ -695,6 +701,9 @@
     "settings.advanced.psk.help": {
         "message": "可选的 WireGuard PSK，用于额外的对称加密。它与 NetBird 设置密钥不同。您将只能与使用相同预共享密钥的对等节点通信。"
     },
+    "settings.advanced.psk.configured": {
+        "message": "已设置预共享密钥，输入新密钥即可替换。"
+    },
     "settings.troubleshooting.section.title": {
         "message": "调试包"
     },