feat: add backend DNS resolution check and improve gateway sync reliability

Add wait_for_backend_dns function to verify backend hostname resolution before attempting bootstrap/sync operations. Configure NEXAVPN_BACKEND_HOST environment variable and net.ipv4.ip_forward sysctl in docker-compose. Use atomic write pattern for state.json via temporary file to prevent corruption on failed downloads. Make sysctl ip_forward call conditional on write permissions and non-fatal.

deploy/docker-compose.yml

@@ -57,6 +57,8 @@ services:
       dockerfile: gateway/Dockerfile
     depends_on:
       - backend
+    sysctls:
+      net.ipv4.ip_forward: "1"
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
@@ -75,6 +77,7 @@ services:
       NEXAVPN_GATEWAY_INTERFACE: ${NEXAVPN_GATEWAY_INTERFACE:-wg0}
       NEXAVPN_UPLINK_INTERFACE: ${NEXAVPN_UPLINK_INTERFACE:-eth0}
       NEXAVPN_ENABLE_MASQUERADE: ${NEXAVPN_ENABLE_MASQUERADE:-true}
+      NEXAVPN_BACKEND_HOST: ${NEXAVPN_BACKEND_HOST:-backend}
     volumes:
       - ./scripts/gateway-entrypoint.sh:/scripts/gateway-entrypoint.sh:ro
       - gateway-state:/var/lib/nexavpn