Enable WireGuard service, change HTTPFetchClient to use wireguard proxy, and add required env vars

Add WireGuard-related env variables to .env.example (addresses,
keys, endpoint, DNS)
Resolve WIREGUARD_ENDPOINT_HOST to WIREGUARD_ENDPOINT_IP in
cicd/scripts/deploy.sh and write it to .env, failing if unresolved
Un-comment and enable the wireguard service in docker-compose.yml
Remove an obsolete commented workflow snippet

src/lib/HttpFetchClient.ts

@@ -1,43 +1,53 @@
+import { ofetch } from "ofetch";
+import { ProxyAgent } from "undici";
+
+const wireguardDispatcher = new ProxyAgent("http://wireguard:8888");
+
 const httpFetchClient = {
   get: async (url: string, headers: Record<string, string>) => {
-    const response = await fetch(url, {
+    const response = await ofetch(url, {
       method: "GET",
       headers,
+      dispatcher: wireguardDispatcher,
     });
 
     return response.json();
   },
   post: async (url: string, body: JSON, headers: Record<string, string>) => {
-    const response = await fetch(url, {
+    const response = await ofetch(url, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
+      dispatcher: wireguardDispatcher,
     });
 
     return response.json();
   },
   put: async (url: string, body: JSON, headers: Record<string, string>) => {
-    const response = await fetch(url, {
+    const response = await ofetch(url, {
       method: "PUT",
       headers,
       body: JSON.stringify(body),
+      dispatcher: wireguardDispatcher,
     });
 
     return response.json();
   },
   patch: async (url: string, body: JSON, headers: Record<string, string>) => {
-    const response = await fetch(url, {
+    const response = await ofetch(url, {
       method: "PATCH",
       headers,
       body: JSON.stringify(body),
+      dispatcher: wireguardDispatcher,
     });
 
     return response.json();
   },
   delete: async (url: string, headers: Record<string, string>) => {
-    const response = await fetch(url, {
+    const response = await ofetch(url, {
       method: "DELETE",
       headers,
+      dispatcher: wireguardDispatcher,
     });
 
     return response.json();

src/pages/cap/challenge.ts

@@ -4,13 +4,16 @@ export const prerender = false;
 
 export const POST: APIRoute = async () => {
   try {
+    return new Response(JSON.stringify(await cap.createChallenge()), {
+      status: 200,
+    });
+  } catch (error) {
     return new Response(
-      JSON.stringify(await cap.createChallenge({ challengeDifficulty: 4 })),
-      {
-        status: 200,
-      },
+      JSON.stringify({
+        success: false,
+        error: error instanceof Error ? error.message : String(error),
+      }),
+      { status: 400 },
     );
-  } catch {
-    return new Response(JSON.stringify({ success: false }), { status: 400 });
   }
 };