feat: add DNS server routes to WireGuard profiles and gateway firewall rules

Add mergeProfileAllowedIPs function to combine policy destinations with DNS server routes in device enrollment and rotation. Add dnsServerRoute helper to convert DNS server IPs to /32 CIDR notation. Update BuildSyncBundle query to include gateway DNS servers in peer data. Add DNSServers field to wireguard.Peer struct. Update gateway nftables configuration to allow UDP/TCP port 53 traffic from assigned IPs to DNS servers before

backend/internal/wireguard/types.go

@@ -5,6 +5,7 @@ type Peer struct {
 	PublicKey           string   `json:"public_key"`
 	AssignedIP          string   `json:"assigned_ip"`
 	AllowedDestinations []string `json:"allowed_destinations"`
+	DNSServers          []string `json:"dns_servers"`
 }
 
 type GatewayBundle struct {