feat(pia): add PIA login-and-add WireGuard outbounds (#6272)

* feat(pia): add login-and-add WireGuard outbounds (#2)

* fix(pia): keep PIA outbounds identifiable after the editor strips hostname

The outbound editor drops piaHostname, so last-segment matching failed for hyphenated servers. Identify rows by the computed tag, re-encrypt stored tokens onto the active key, skip unusable catalog rows, and always release the catalog refresh latch.

internal/pia/testdata/serverlist/invalid_signature.txt

@@ -0,0 +1,3 @@
+{"version":6,"groups":{},"regions":[]}
+
+QUFBQQ==

internal/pia/testdata/serverlist/malformed.json

@@ -0,0 +1 @@
+{"version":6,"groups":{},"regions":[{"id":12}]}

internal/pia/testdata/serverlist/v6_valid.json

@@ -0,0 +1 @@
+{"version":6,"groups":{"wg":[{"name":"wireguard","ports":[1337]}]},"regions":[{"id":"us-east","name":"US East","country":"US","geo":false,"offline":false,"port_forward":true,"servers":{"wg":[{"ip":"198.51.100.10","cn":"useast401"}]}}]}

internal/pia/testdata/serverlist/v7_valid.json

@@ -0,0 +1 @@
+{"version":"v7","groups":{"wg":[{"name":"wireguard","ports":[1337]}]},"regions":[{"id":"de-berlin","name":"Germany Berlin","country":"DE","geo":true,"offline":false,"port_forwarding":false,"servers":{"wg":[{"ip":"203.0.113.20","hostname":"berlin501"}]}}]}