feat(helm): add WireGuard deployment and service templates

Privileged deployment with NET_ADMIN, sysctl ip_forward, tun device
mount, and UDP LoadBalancer service on port 51820.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/helm/templates/wireguard-service.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.wireguard.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "tod.fullname" . }}-wireguard
+  labels:
+    {{- include "tod.componentLabels" (dict "context" . "component" "wireguard") | nindent 4 }}
+spec:
+  type: {{ .Values.wireguard.service.type | default "LoadBalancer" }}
+  ports:
+    - name: wireguard
+      port: {{ .Values.wireguard.service.port }}
+      targetPort: wireguard
+      protocol: UDP
+  selector:
+    {{- include "tod.componentSelectorLabels" (dict "context" . "component" "wireguard") | nindent 4 }}
+{{- end }}