Move the WireGuard handshake watcher out of the peer package into client/internal/peer/wg_watcher. The test stays an internal test since it drives the unexported checkPeriod. Update conn.go to reference the watcher through the package.