One-command vault edit (replace flossfw.public_key) + wireguard-server redeploy + verify handshake, for when the TaPPaaS operator sends their WireGuard public key. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>