feat(server): add configurable client endpoint and allowed IPs for generated VPN configs

ts/smartvpn.interfaces.ts

@@ -129,6 +129,14 @@ export interface IVpnServerConfig {
    *  Controls where decrypted traffic goes: allow through, block, or redirect to a target.
    *  Default: all traffic passes through (backward compatible). */
   destinationPolicy?: IDestinationPolicy;
+  /** Public endpoint address for generated client configs (e.g. 'vpn.example.com:51820').
+   *  Used as the WireGuard `Endpoint =` and SmartVPN `serverUrl` host.
+   *  Defaults to listenAddr (which is typically wrong for remote clients). */
+  serverEndpoint?: string;
+  /** AllowedIPs for generated WireGuard client configs.
+   *  Controls what traffic the client routes through the VPN tunnel.
+   *  Defaults to ['0.0.0.0/0'] (full tunnel). Set to e.g. ['10.8.0.0/24'] for split tunnel. */
+  clientAllowedIPs?: string[];
 }
 
 /**