Which tunnel peer gets this packet? Parse a VPN peer config, longest-prefix routing, ownership moves and findings

# Which tunnel peer gets this packet? Our home-lab VPN box uses WireGuard-style configs (sample: `home.conf`). `wgroute.py` is meant to answer "which peer would a packet to IP X be sent to?" and to list config problems, but the draft is wrong in many ways. Rewrite `wgroute.py` (Python 3 stdlib only; `ipaddress` is fine) so that `WGConfig(text)` exposes `.peers()`, `.route(ip)` and `.findings` exactly as below. ## Parsing 1. Lines are numbered from 1. `#` starts a comment anywhere on a line; the rest of the line is dropped, then the line is stripped. Empty lines are skipped. 2. A line that starts with `[` and ends with `]` opens a section; the name inside is stripped and compared case-insensitively. Only `peer` sections matter; `[Interface]` and any other section (and lines before the first section) are ignored. 3. Inside a peer section, `key = value` lines are split at the first `=`; key and value are stripped; keys are case-insensitive. Lines without `=` and unknown keys are ignored. `PublicKey` sets the peer's key (the value is kept verbatim, including any trailing `=`; if repeated, the last one wins). `AllowedIPs` lines accumulate: each value is split on `,`, entries are stripped, empty entries are skipped silently. 4. A peer section is processed when the next section header or the end of the text is reached, in file order: - no PublicKey -> finding `("missing_key", header_line)`, the section is skipped; - a PublicKey already used by an earlier processed peer -> finding `("duplicate_peer", key, header_line)`, the whole section is skipped; - otherwise each AllowedIPs entry in order: it is an IPv4/IPv6 address or CIDR; a bare address means /32 or /128; host bits are cleared (`10.0.0.9/24` -> `10.0.0.0/24`). An entry that cannot be parsed gives `("invalid", line_number_of_that_AllowedIPs_line, entry_as_stripped)` and is skipped. 5. **Ownership.** Each normalised prefix belongs to at most one peer. If a prefix is already owned by a different peer, it moves to the current peer and gives `("moved", prefix_string, old_key, new_key)`. Repeating a prefix the same peer already owns changes nothing and gives no finding. 6. `.findings` is the list of these tuples in the order they were produced. Prefix strings use Python's `str(ipaddress.ip_network(...))` form. ## Queries 7. `.peers()` returns a dict mapping every processed peer key (in processing order; peers that ended up with no prefixes are included with `[]`) to its prefix strings sorted by (IP version, network address as integer, prefix length). 8. `.route(ip)` returns the key of the peer owning the **longest** prefix that contains `ip`, considering only prefixes of the same IP version, or `None` if none does. Surrounding whitespace in `ip` is ignored. An IPv4-mapped IPv6 address (`::ffff:a.b.c.d`) is looked up as the IPv4 address `a.b.c.d`. An invalid address raises `ValueError`. 9. **Speed.** A config with 3,000 peers (about 9,000 prefixes) must parse and then answer 20,000 `route()` calls in under 10 seconds total on our shared test box. ## Scoring Hidden check groups (partial credit = fraction passed; all must pass): `parse_sections_comments` (1-3), `skip_rules_findings` (4, 6), `normalise_and_invalid` (4), `ownership_moves` (5, 6), `peers_listing` (7), `longest_prefix` (8), `mapped_and_errors` (8), `randomized_agreement` (300 random configs of small random prefixes compared on peers(), findings and 50 routes each), `speed` (9). On `home.conf` the correct `.route("10.8.0.2")` is `"PHONEkey="`.