feat(core): expose WireGuard client traffic metrics (#2537)

* feat(core): expose WireGuard client traffic metrics

Count successfully accepted upload and delivered download packets
per VPN portal client. Keep counters stable across session reconnects
and export them through the existing Prometheus statistics endpoint.

If a client is removed by a concurrent config update while one of its
sessions is still starting, drop that session instead of panicking:
the release profile aborts the whole process on panic.

* ci(core): pin cargo-zigbuild to 0.23.2

cargo-zigbuild 0.23.3 (released today) passes
-mcpu=generic+v6+strict_align to zig cc when building jemalloc for
arm-unknown-linux-musleabi; zig 0.16.0 rejects that mcpu value, so the
linux-arm job fails and fail-fast cancels the rest of the build matrix.
Pin the tool to the last working version until zig is bumped.

.github/workflows/core.yml

@@ -165,7 +165,10 @@ jobs:
       - uses: taiki-e/install-action@v2
         if: ${{ contains(matrix.OS, 'ubuntu') }}
         with:
-          tool: cargo-zigbuild
+          # v0.23.3 emits -mcpu=generic+v6+strict_align for
+          # arm-unknown-linux-musleabi, which zig 0.16.0 rejects;
+          # unpin only together with a zig bump.
+          tool: cargo-zigbuild@0.23.2
 
       - name: Build
         if: ${{ !contains(matrix.TARGET, 'mips') }}