feat: flexible IPv4/IPv6 support with independent endpoint and client addressing (#1419)

## Summary

Comprehensive IPv4/IPv6 overhaul that decouples server endpoint
addressing from client tunnel addressing, supporting all combinations
with automatic leak prevention.

### Supported Configurations

| Endpoint | Client Mode | Description |
|----------|-------------|-------------|
| IPv4 | IPv4-only | Traditional setup (4→4) |
| IPv4 | Dual-stack | IPv4 endpoint, clients get both (4→4/6) |
| IPv4 | IPv6-only | IPv4 endpoint, clients get IPv6 only (4→6) |
| IPv6 | IPv4-only | IPv6 endpoint, clients get IPv4 only (6→4) |
| IPv6 | Dual-stack | IPv6 endpoint, clients get both (6→4/6) |
| IPv6 | IPv6-only | Full IPv6 setup (6→6) |

### Leak Prevention

- **IPv4-only mode**: Pushes `block-ipv6` to clients, blocking all IPv6
traffic
- **IPv6-only mode**: Assigns IPv4 addresses and pushes
`redirect-gateway def1` to capture IPv4 traffic, which is then dropped
(no IPv4 NAT configured)
- **Dual-stack mode**: Both protocols tunneled normally

### New CLI Options

```
Network Options:
  --endpoint-type <4|6>     Endpoint IP version (default: 4)
  --client-ipv4             Enable IPv4 for VPN clients (default: enabled)
  --no-client-ipv4          Disable IPv4 for VPN clients
  --client-ipv6             Enable IPv6 for VPN clients (default: disabled)
  --no-client-ipv6          Disable IPv6 for VPN clients
  --subnet-ipv4 <x.x.x.0>   IPv4 VPN subnet (default: 10.8.0.0)
  --subnet-ipv6 <prefix>    IPv6 VPN subnet (default: fd42:42:42:42::)
```

### Usage Examples

```bash
# Dual-stack clients (IPv4 + IPv6)
./openvpn-install.sh install --client-ipv4 --client-ipv6

# IPv6-only clients (IPv4 traffic blocked)
./openvpn-install.sh install --no-client-ipv4 --client-ipv6

# IPv4-only clients (IPv6 traffic blocked) - default behavior
./openvpn-install.sh install --client-ipv4 --no-client-ipv6

# IPv6 server endpoint
./openvpn-install.sh install --endpoint-type 6 --endpoint 2001:db8::1

# Custom subnets
./openvpn-install.sh install --client-ipv6 --subnet-ipv4 10.9.0.0 --subnet-ipv6 fd00🔢5678::
```

### Implementation Details

**Core changes:**
- New `ENDPOINT_TYPE` variable (4 or 6) controls server listening
protocol
- New `CLIENT_IPV4`/`CLIENT_IPV6` variables control client tunnel
addressing
- Renamed `VPN_SUBNET` → `VPN_SUBNET_IPV4`, added `VPN_SUBNET_IPV6`
- Separate `resolvePublicIPv4()` and `resolvePublicIPv6()` functions
- New `validate_subnet_ipv6()` for ULA (fd00::/8) validation

**Protocol handling:**
- Uses `proto udp6`/`tcp6` when endpoint type is IPv6
- Firewall and SELinux commands handle both protocol variants

**Firewall updates:**
- firewalld: Conditional IPv6 masquerade and forwarding
- nftables: Separate ip/ip6 tables for NAT based on client config
- iptables: ip6tables rules only when IPv6 clients enabled

**DNS configuration:**
- Unbound listens on IPv4/IPv6 gateway addresses as needed
- All third-party DNS providers now include IPv6 servers:
  - Cloudflare: 2606:4700:4700::1111
  - Quad9: 2620:fe::fe
  - Google: 2001:4860:4860::8888
  - OpenDNS: 2620:119:35::35
  - AdGuard: 2a10:50c0::ad1:ff

**CI/Testing:**
- Added `ubuntu-24.04-dual-stack` test matrix entry
- Docker test container enables IPv6 forwarding
- `CLIENT_IPV6` environment variable passed to test container

## Test Plan

- [x] Shellcheck passes
- [x] CI Docker tests pass (including new dual-stack test)
- [x] Manual testing: IPv4-only mode blocks IPv6 traffic
- [x] Manual testing: IPv6-only mode blocks IPv4 traffic
- [x] Manual testing: Dual-stack mode tunnels both protocols

---

Closes #1317
Closes #1288
Closes #1084
Closes #701
Closes #350

test/client-entrypoint.sh

@@ -26,11 +26,16 @@ cat /shared/client.ovpn
 if [ -f /shared/vpn-config.env ]; then
 	# shellcheck source=/dev/null
 	source /shared/vpn-config.env
-	echo "VPN config loaded: VPN_SUBNET=$VPN_SUBNET, VPN_GATEWAY=$VPN_GATEWAY"
+	echo "VPN config loaded: VPN_SUBNET_IPV4=$VPN_SUBNET_IPV4, VPN_GATEWAY=$VPN_GATEWAY"
+	if [ "${CLIENT_IPV6:-n}" = "y" ]; then
+		# shellcheck disable=SC2153 # Variables are sourced from vpn-config.env
+		echo "IPv6 enabled: VPN_SUBNET_IPV6=$VPN_SUBNET_IPV6, VPN_GATEWAY_IPV6=$VPN_GATEWAY_IPV6"
+	fi
 else
 	echo "WARNING: vpn-config.env not found, using defaults"
-	VPN_SUBNET="10.8.0.0"
+	VPN_SUBNET_IPV4="10.8.0.0"
 	VPN_GATEWAY="10.8.0.1"
+	CLIENT_IPV6="n"
 fi
 
 # Connect to VPN
@@ -60,24 +65,49 @@ sleep 5
 echo ""
 echo "=== Running connectivity tests ==="
 
-# Test 1: Check tun0 interface
-echo "Test 1: Checking tun0 interface..."
+# Test 1: Check tun0 interface (IPv4)
+echo "Test 1: Checking tun0 interface (IPv4)..."
 # Extract base of subnet (e.g., "10.9.0" from "10.9.0.0")
-VPN_SUBNET_BASE="${VPN_SUBNET%.*}"
+VPN_SUBNET_BASE="${VPN_SUBNET_IPV4%.*}"
 if ip addr show tun0 | grep -q "$VPN_SUBNET_BASE"; then
-	echo "PASS: tun0 interface has correct IP range (${VPN_SUBNET_BASE}.x)"
+	echo "PASS: tun0 interface has correct IPv4 range (${VPN_SUBNET_BASE}.x)"
 else
-	echo "FAIL: tun0 interface doesn't have expected IP"
+	echo "FAIL: tun0 interface doesn't have expected IPv4"
 	exit 1
 fi
 
-# Test 2: Ping VPN gateway (retries indefinitely, relies on job timeout)
-echo "Test 2: Pinging VPN gateway ($VPN_GATEWAY)..."
+# Test 1b: Check tun0 IPv6 address (if IPv6 enabled)
+if [ "${CLIENT_IPV6:-n}" = "y" ]; then
+	echo "Test 1b: Checking tun0 interface (IPv6)..."
+	# Extract prefix of subnet (e.g., "fd42:42:42:42" from "fd42:42:42:42::")
+	VPN_SUBNET_IPV6_PREFIX="${VPN_SUBNET_IPV6%::}"
+	if ip -6 addr show tun0 | grep -q "$VPN_SUBNET_IPV6_PREFIX"; then
+		echo "PASS: tun0 interface has correct IPv6 range (${VPN_SUBNET_IPV6_PREFIX}::x)"
+	else
+		echo "FAIL: tun0 interface doesn't have expected IPv6"
+		ip -6 addr show tun0
+		exit 1
+	fi
+fi
+
+# Test 2: Ping VPN gateway (IPv4) (retries indefinitely, relies on job timeout)
+echo "Test 2: Pinging VPN gateway (IPv4) ($VPN_GATEWAY)..."
 while ! ping -c 3 -W 2 "$VPN_GATEWAY" >/dev/null 2>&1; do
 	echo "Ping failed, retrying..."
 	sleep 3
 done
-echo "PASS: Can ping VPN gateway"
+echo "PASS: Can ping VPN gateway (IPv4)"
+
+# Test 2b: Ping VPN gateway (IPv6, if enabled)
+if [ "${CLIENT_IPV6:-n}" = "y" ]; then
+	echo "Test 2b: Pinging VPN gateway (IPv6) ($VPN_GATEWAY_IPV6)..."
+	if ping6 -c 5 "$VPN_GATEWAY_IPV6"; then
+		echo "PASS: Can ping VPN gateway (IPv6)"
+	else
+		echo "FAIL: Cannot ping VPN gateway (IPv6)"
+		exit 1
+	fi
+fi
 
 # Test 3: DNS resolution through Unbound
 echo "Test 3: Testing DNS resolution via Unbound ($VPN_GATEWAY)..."