Add fail-closed WireGuard container gateway

platform/docker/wireguard-gateway/Dockerfile

@@ -0,0 +1,13 @@
+FROM debian:13-slim
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+       ca-certificates iproute2 iptables procps socat wireguard-tools \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY entrypoint.sh /usr/local/sbin/mike-ai-wireguard-entrypoint
+COPY healthcheck.sh /usr/local/sbin/mike-ai-wireguard-healthcheck
+RUN chmod 0755 /usr/local/sbin/mike-ai-wireguard-entrypoint \
+               /usr/local/sbin/mike-ai-wireguard-healthcheck
+
+ENTRYPOINT ["/usr/local/sbin/mike-ai-wireguard-entrypoint"]