Deploy a production-ready WireGuard VPN with wg-easy, Caddy, Let’s Encrypt, UFW, fail2ban, unattended-upgrades, backups, health checks, and a TUI installer — all on Debian…