feat: add automated WireGuard runtime installation for Windows desktop client with bundled MSI installer

Add install-runtime command to tunnel-helper for automated WireGuard installation on Windows. Download and bundle official WireGuard MSI during build process with automatic version discovery from wireguard.com.

Add ensure_windows_runtime_installed checks before connect/disconnect operations. Implement install_windows_runtime with UAC elevation prompt and install_windows_runtime_direct for MS

desktop-client/scripts/build-tunnel-helper.sh

@@ -78,6 +78,28 @@ else
 fi
 install -m 755 "${HELPER_DIR}/target/${TARGET}/release/${OUTPUT_NAME}" "${OUTPUT_DIR}/${OUTPUT_NAME}"
 
+if [ "${TARGET}" = "x86_64-pc-windows-msvc" ]; then
+  if ! command -v curl >/dev/null 2>&1; then
+    echo "curl is required to bundle the official WireGuard Windows MSI."
+    exit 1
+  fi
+
+  MSI_URL="${NEXAVPN_WIREGUARD_WINDOWS_MSI_URL:-}"
+  if [ -z "${MSI_URL}" ]; then
+    INDEX_HTML="$(curl -fsSL https://download.wireguard.com/windows-client/)"
+    MSI_NAME="$(printf '%s' "${INDEX_HTML}" | grep -oE 'wireguard-amd64-[0-9.]+\.msi' | sort -uV | tail -n 1)"
+    if [ -z "${MSI_NAME}" ]; then
+      echo "Unable to discover the latest official WireGuard Windows MSI."
+      exit 1
+    fi
+    MSI_URL="https://download.wireguard.com/windows-client/${MSI_NAME}"
+  fi
+
+  echo "Bundling WireGuard Windows runtime from ${MSI_URL}"
+  rm -f "${OUTPUT_DIR}/wireguard-installer.msi"
+  curl -fsSL "${MSI_URL}" -o "${OUTPUT_DIR}/wireguard-installer.msi"
+fi
+
 if [ "${TARGET}" = "aarch64-apple-darwin" ]; then
   WG_BIN="$(command -v wg || true)"
   WG_QUICK_BIN="$(command -v wg-quick || true)"