Introduces a forced WG handshake on initial MLKEM bootstrap.

To ensure two peers agree on a key, we need asymmetry. one peer is
the controller ("initiator") the other is the "responder".

Otherwise imagine two offers in parallel driving two answers at the same time

   A                   B
   | <----B-OFFER----- |
   | -----A-OFFER----> |
   |                   |
   |                   |
   ---------------------------------
  |****** ICE + WG Handshake ****** |
   ---------------------------------
   |                   |
   | <----B-ANSWER---- |
   | -----A-ANSWER---> |

PSK is derived on receive of offer, so A and B derive different PSKs.
When WG handshake takes place it picks misaligned PSKs.

So we impair the two nodes and only the offer of one of the two (the controller/initiator)
carries the KEM material.

This means that if the responder OFFER/ANSWER comes first, when the controller/initiator's one
completes (and the genuine PSK is shared between A and B, we need to force a new WG handshake with
the proper keys.

client/internal/peer/conn.go

@@ -736,6 +736,35 @@ func (conn *Conn) RequestReoffer() {
 	}
 }
 
+// ForcePQRehandshake makes WireGuard adopt a freshly bootstrapped post-quantum PSK on
+// an already-up session. The KEM exchange can complete after the WG endpoint was
+// configured (a race between the KEM and the relay/ICE connection coming up), so the
+// live session may be keyed with a pre-PQ key (the strict sentinel, or the ordinary
+// key in permissive mode); SetPresharedKey only updates config, not the running
+// session. Removing and re-adding the peer forces a fresh handshake that uses the real
+// PSK. No-op if not connected yet (the upcoming endpoint config will pull the PSK) or
+// if no PSK exists (a non-PQ peer stays fail-closed).
+func (conn *Conn) ForcePQRehandshake() {
+	conn.mu.Lock()
+	defer conn.mu.Unlock()
+
+	if conn.ctx.Err() != nil || conn.config.PQ == nil {
+		return
+	}
+	psk, ok := conn.config.PQ.PSK(conn.config.Key)
+	if !ok {
+		return
+	}
+	if conn.currentConnPriority == conntype.None {
+		return
+	}
+	conn.Log.Debugf("pqkem: bootstrap PSK ready, forcing WireGuard re-handshake to adopt it")
+	wgPsk := wgtypes.Key(psk)
+	if err := conn.endpointUpdater.ForceRehandshake(&wgPsk); err != nil {
+		conn.Log.Warnf("pqkem: force re-handshake failed: %v", err)
+	}
+}
+
 func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()

client/internal/peer/endpoint.go

@@ -20,10 +20,13 @@ type EndpointUpdater struct {
 	wgConfig  WgConfig
 	initiator bool
 
-	// mu protects cancelFunc
+	// mu protects cancelFunc and lastEndpoint
 	mu         sync.Mutex
 	cancelFunc func()
 	updateWg   sync.WaitGroup
+	// lastEndpoint is the most recent non-nil endpoint applied to the peer, used to
+	// re-add it on a forced re-handshake (ForceRehandshake).
+	lastEndpoint *net.UDPAddr
 }
 
 func NewEndpointUpdater(log *logrus.Entry, wgConfig WgConfig, initiator bool) *EndpointUpdater {
@@ -38,6 +41,10 @@ func (e *EndpointUpdater) ConfigureWGEndpoint(addr *net.UDPAddr, presharedKey *w
 	e.mu.Lock()
 	defer e.mu.Unlock()
 
+	if addr != nil {
+		e.lastEndpoint = addr
+	}
+
 	if e.initiator {
 		e.log.Debugf("configure up WireGuard as initiator")
 		return e.configureAsInitiator(addr, presharedKey)
@@ -51,12 +58,36 @@ func (e *EndpointUpdater) SwitchWGEndpoint(addr *net.UDPAddr, presharedKey *wgty
 	e.mu.Lock()
 	defer e.mu.Unlock()
 
+	if addr != nil {
+		e.lastEndpoint = addr
+	}
+
 	// prevent to run new update while cancel the previous update
 	e.waitForCloseTheDelayedUpdate()
 
 	return e.updateWireGuardPeer(addr, presharedKey)
 }
 
+// ForceRehandshake removes and re-adds the peer so WireGuard drops the current session
+// and negotiates a fresh one with the given PSK. Used when a post-quantum PSK is
+// bootstrapped after the session already came up on a pre-PQ key. No-op if no endpoint
+// has been applied yet (the pending config will pull the PSK itself).
+func (e *EndpointUpdater) ForceRehandshake(presharedKey *wgtypes.Key) error {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	if e.lastEndpoint == nil {
+		return nil
+	}
+	// Cancel any pending delayed responder update: it carries the stale pre-PQ key and
+	// would otherwise re-poison the session after we reset it.
+	e.waitForCloseTheDelayedUpdate()
+	if err := e.wgConfig.WgInterface.RemovePeer(e.wgConfig.RemoteKey); err != nil {
+		return err
+	}
+	return e.updateWireGuardPeer(e.lastEndpoint, presharedKey)
+}
+
 func (e *EndpointUpdater) RemoveWgPeer() error {
 	e.mu.Lock()
 	defer e.mu.Unlock()