feat(pia): add PIA login-and-add WireGuard outbounds (#6272)

* feat(pia): add login-and-add WireGuard outbounds (#2)

* fix(pia): keep PIA outbounds identifiable after the editor strips hostname

The outbound editor drops piaHostname, so last-segment matching failed for hyphenated servers. Identify rows by the computed tag, re-encrypt stored tokens onto the active key, skip unusable catalog rows, and always release the catalog refresh latch.

internal/pia/endpoints.go

@@ -0,0 +1,24 @@
+package pia
+
+import (
+	_ "embed"
+	"time"
+)
+
+const (
+	DefaultTokenEndpoint      = "https://www.privateinternetaccess.com/api/client/v2/token"
+	DefaultServerListEndpoint = "https://serverlist.piaservers.net/vpninfo/servers/v6"
+	DefaultAddKeyPort         = uint16(1337)
+	DefaultUserAgent          = "3x-ui-pia/1.0"
+	DefaultMaxServerListBody  = int64(8 << 20)
+	DefaultMaxResponseBody    = int64(64 << 10)
+	DefaultRequestTimeout     = 20 * time.Second
+	DefaultCatalogFreshTTL    = 6 * time.Hour
+	DefaultTokenTTL           = 24 * time.Hour
+)
+
+//go:embed trust/ca.rsa.4096.crt
+var EmbeddedPIACA []byte
+
+//go:embed trust/serverlist_public_key.pem
+var EmbeddedServerListPublicKey []byte