feat(vpn): expose Athena services directly over WireGuard

config/install.env.example

@@ -33,6 +33,8 @@ SSH_KEY_ONLY=true
 WIREGUARD_MODE=container
 WIREGUARD_CONFIG_FILE=/etc/mike-ai/wireguard/fritz-athena.conf
 WIREGUARD_ENABLE=false
+# Stable Fritzbox/WireGuard address used by direct VPN clients such as Pi or Hermes.
+VPN_SERVICE_IP=192.168.1.212
 # The values below are only used by the legacy host-terminated mode. The
 # default container mode takes address, peer and routes from the Fritzbox file.
 AI_BIND_ADDRESS=10.77.0.2