feat: add web proxy target allowlist support via NEXAVPN_ALWAYS_ALLOW_WEB_PROXY_IPS environment variable

Add alwaysAllowWebProxyTargets function to parse comma-separated IPs from NEXAVPN_ALWAYS_ALLOW_WEB_PROXY_IPS environment variable with deduplication. Update mergeProfileAllowedIPs to accept webProxyTargets parameter and merge them into profile allowed IPs using /32 routes. Add WebProxyTargets field to wireguard.Peer struct and populate it in BuildSyncBundle and device enrollment/policy application

backend/internal/wireguard/types.go

@@ -6,6 +6,7 @@ type Peer struct {
 	AssignedIP          string   `json:"assigned_ip"`
 	AllowedDestinations []string `json:"allowed_destinations"`
 	DNSServers          []string `json:"dns_servers"`
+	WebProxyTargets     []string `json:"web_proxy_targets"`
 }
 
 type GatewayBundle struct {