Re-resolve WireGuard peers' endpoint names

systemd-networkd resolves an endpoint name once, when it creates the
device. A peer behind a dynamic DNS name that changes its address was
never found again until the next restart.

A timer (router.wireguardEndpointRefresh, default 1min, null for off)
runs wg set for the peers with a name whose last handshake is older than
135 seconds, as wireguard-tools' reresolve-dns does. Working tunnels are
left alone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/options.nix

@@ -426,6 +426,20 @@ in
       );
     };
 
+    wireguardEndpointRefresh = mkOption {
+      type = types.nullOr (types.strMatching "[0-9]+(s|min|h)");
+      default = "1min";
+      example = "5min";
+      description = ''
+        How often the names in WireGuard peers' `endpoint` are looked up
+        again, for peers that have not completed a handshake in the last two
+        minutes. systemd-networkd resolves a name only when it creates the
+        tunnel, so without this a tunnel whose peer got a new address (dynamic
+        DNS) stays down until the peer contacts the router, or forever if both
+        ends changed. A tunnel that works is not touched. null turns it off.
+      '';
+    };
+
     firewall.zones = mkOption {
       type = types.listOf types.str;
       default = [ ];