feat: add policy-based routing and exit node support

[markwylde]

Summary

• Adds policy-based routing to direct traffic through specific WireGuard peers
• Introduces --exit-node flag for simple VPN-style routing
• Implements --route flag for fine-grained routing control

Features

• Exit Node Support: Use --exit-node=10.0.0.3 to route all traffic through a specific peer
• Policy-Based Routing: Use --route=192.168.0.0/16:10.0.0.3 to route specific subnets
• Configuration File Support: Define routes in WireGuard config with Route= directives
• Routing Engine: Smart peer selection based on destination IP, protocol, and port

Usage Examples

# Route all traffic through peer at 10.0.0.3
wrapguard --config=wg0.conf --exit-node=10.0.0.3 -- curl https://example.com

# Route specific networks through different peers
wrapguard --config=wg0.conf \
  --route=192.168.0.0/16:10.0.0.3 \
  --route=172.16.0.0/12:10.0.0.4 \
  -- ssh internal.corp.com

Test Plan

• Unit tests for routing engine and CLI parsing
• Integration tests for peer selection logic
• Manual testing with multiple peers and routes
• Performance testing with complex routing tables

[markwylde]

This should fix the second issue in #15