🛠️ [Feature]: Implementing NAT Traversal

### What is the feature?

Ghostwire needs a way for two devices to establish a direct WireGuard connection even when the devices are behind NAT routers.

This feature will add NAT traversal support to the client backend. The coordination server will be responsible for helping devices exchange the information required to attempt a direct connection, while the client-side NAT traversal component will handle the connection attempt and update the WireGuard peer endpoint when a usable address is available.

The NAT traversal process will be kept separate from normal Ghostwire traffic so that connection establishment does not depend on application traffic being successfully delivered.

### Technical Implementation

The implementation will be designed to work with the existing kernel-space WireGuard setup rather than replacing or reimplementing WireGuard in userspace.

### Component(s) affected

- [ ] Coordination server
- [x] Clientside Agent (WireGuard / NAT / CLI)
- [ ] Desktop client (Frontend)
- [ ] Docs / infra
- [ ] Other

### Alternatives considered

_No response_

The issue names no files, tests, or entry points. Start by mapping the client-side Agent’s existing kernel-space WireGuard integration and how NAT traversal can remain separate from normal Ghostwire traffic; confirm the intended client-only scope with maintainers. Done should mean clients can attempt a direct connection through NAT and update the WireGuard peer endpoint when a usable address is available.

Written by the indexing model from the issue text.