checkpoint: implement wgcloak v1 foundations

examples/server.minimal.toml

@@ -0,0 +1,22 @@
+# Minimal server. Replace the backend and client secret path before use.
+# The listener address/port is an example; open only the transports you need.
+
+[server]
+listen = "0.0.0.0:51830"
+
+[backend]
+target = "127.0.0.1:51820"
+
+# Milestone 1 direct-UDP deployment. Other transports are planned or optional.
+[transports.quic]
+enabled = false
+
+[transports.http3]
+enabled = false
+
+[transports.tls_tcp]
+enabled = false
+
+[[auth.clients]]
+id = "replace-me"
+secret_file = "/etc/wgcloak/clients/replace-me.secret"