stacks(wgtunnel): mirror deployed wstunnel server stack from ana-docker

wgtunnel deployed + accepted end-to-end (tunnel-dev): erebe/wstunnel v10.6.2 behind
traefik on ana-docker, Host boring.phasefinal.com (Mode A anaprod cert), --restrict-to
ana-wg:31337 (not an open relay). Mirror per fleet convention; full project in vh/wgtunnel.

stacks/wgtunnel/.env.example

@@ -0,0 +1,19 @@
+# wgtunnel server stack — host env template.
+# Copy to `.env` next to compose.yaml on ana-docker and adjust as needed.
+# This template is committed; the real `.env` is gitignored (it is not secret
+# today, but the pattern keeps host-specific values out of git).
+
+# Pinned erebe/wstunnel image tag. NEVER :latest. (v10.6.2 verified as the current
+# stable release, and `server --restrict-to <DEST:PORT>` confirmed against its --help.)
+WGTUNNEL_IMAGE_TAG=v10.6.2
+
+# The WireGuard endpoint wstunnel unwraps to (ana-wg). `--restrict-to` enforces
+# that the server forwards only here — it is not an open relay.
+WG_TARGET=10.250.50.252:31337
+
+# Public hostname — a deliberately innocuous SNI. DNS-only CNAME to the colo edge
+# (ana-srv1.phasefinal.com); never Cloudflare-proxied.
+TUNNEL_HOST=boring.phasefinal.com
+
+# Internal plain-WebSocket port the container listens on; traefik forwards here.
+WSTUNNEL_PORT=8080