Replace WireGuard prototype with native host service and scoped access

backup.py

@@ -97,7 +97,7 @@ def validate(doc):
   if not isinstance(network,dict) or set(network)!={'config','enabled','mode'} or type(network['enabled']) is not bool or network['mode'] not in ('lan','both','tunnel'):raise ValueError('Ungültiger Netzwerkstand.')
   if network['config'] is not None:
    from network.config import parse_config
-   parse_config(network['config'])
+   parse_config(network['config'],native=True)
  services=doc.get('services')
  if not isinstance(services,list) or len(services)>50:raise ValueError('Ungültiger Containerbestand.')
  # Validation is shared with the root helper, which independently revalidates before Docker calls.