Enable WireGuard service, change HTTPFetchClient to use wireguard proxy, and add required env vars

Add WireGuard-related env variables to .env.example (addresses,
keys, endpoint, DNS)
Resolve WIREGUARD_ENDPOINT_HOST to WIREGUARD_ENDPOINT_IP in
cicd/scripts/deploy.sh and write it to .env, failing if unresolved
Un-comment and enable the wireguard service in docker-compose.yml
Remove an obsolete commented workflow snippet

astro.config.mjs

@@ -18,12 +18,13 @@ export default defineConfig({
   }),
   // adapter: bun(),
   // output: "static",
+  compressHTML: false,
   devToolbar: { enabled: false },
   prefetch: {
     prefetchAll: true,
   },
   security: {
-    checkOrigin: true,
+    checkOrigin: false,
   },
   session: {
     driver: "lru-cache",