feat(vpn): VPN on-demand Tailscale + agent studioE5 standalone

- Agent studioE5 standalone en Go (console + systray)
- VPN on-demand via tailscaled + tailscale up (authkey Headscale)
- Resolver/serveur dans le tailnet studioe5
- Caddy on-demand TLS pour les instances
- Nouveaux endpoints serveur /api/internal/send-to-node
- Suppression des anciens binaires edubox-agent
- Suivi dans SUIVI_VPN_ONDEMAND.md

agent/docker.go

@@ -20,18 +20,20 @@ func getContainerEngine() string {
 	return "docker"
 }
 
-func writeCompose(dataDir, instanceID, compose string) error {
+func writeCompose(dataDir, instanceID, compose string, port int) error {
 	dir := instanceDir(dataDir, instanceID)
 	if err := os.MkdirAll(dir, 0755); err != nil {
 		return err
 	}
 
-	// Ensure the EduBox mu-plugin is available and substitute its path
+	// Ensure the studioE5 mu-plugin is available and substitute its path
 	muDir, err := writeMUPlugin(dataDir)
 	if err != nil {
 		return err
 	}
 	compose = strings.ReplaceAll(compose, "{MU_PLUGINS_DIR}", filepath.Dir(muDir))
+	compose = strings.ReplaceAll(compose, "{INSTANCE_ID}", instanceID)
+	compose = strings.ReplaceAll(compose, "{PORT}", fmt.Sprintf("%d", port))
 
 	f := filepath.Join(dir, "docker-compose.yml")
 	return os.WriteFile(f, []byte(compose), 0644)
@@ -115,7 +117,7 @@ fi
 }
 
 // stripWordPressHardcodedURLs removes hardcoded WP_HOME/WP_SITEURL defines
-// from wp-config.php so the EduBox mu-plugin can compute them from the Host
+// from wp-config.php so the studioE5 mu-plugin can compute them from the Host
 // header. This is useful when repairing older instances created before the
 // mu-plugin existed.
 func stripWordPressHardcodedURLs(dataDir, instanceID string) error {