Rename the project to ihasvpn

WGX shares its name with several other WireGuard tools, so the project
becomes ihasvpn, alongside ihasmail.

- Module github.com/Coffey-Labs/ihasvpn, command cmd/ihasvpn, image
  ghcr.io/coffey-labs/ihasvpn.
- Environment variables move from WGX_* to IHASVPN_*. The default database
  is ihasvpn.db, the nftables table is `ihasvpn`, metrics are ihasvpn_*, and
  the session cookie and theme key are renamed, so existing sessions end.
- The mark is the ihasmail cat peeking over the edge of a shield, drawn as
  a vector. docs/brand/generate.py builds the mark, mono mark, wordmarks,
  social card, favicons and app icons from that one drawing.
- The console takes ihasmail's palette: the ihasmail.org teal-navy for dark,
  its contrast-checked light tiers with the site's light accent, received
  traffic in the cat's orange and sent in teal. The wordmark weight and
  font stack follow ihasmail.org.
- Detail values wrap at spaces before breaking inside an address, so an
  IPv6 tunnel address no longer splits mid-number.
- The README history note about the earlier WGX installer is gone with the
  name it explained. Screenshots retaken.

docker-compose.yml

@@ -1,4 +1,4 @@
-# WGX: a WireGuard server with a web admin UI, in one container.
+# ihasvpn: a WireGuard server with a web admin UI, in one container.
 #
 # Start it, open http://<host>:51821, create the first administrator, add a
 # peer, scan the QR code. The container needs NET_ADMIN to create the tunnel
@@ -7,9 +7,9 @@
 # For the highest throughput see docs/performance.md: it explains when to use
 # docker-compose.host.yml (host networking) and which host sysctls matter.
 services:
-  wgx:
-    image: ghcr.io/coffey-labs/wgx:latest
-    container_name: wgx
+  ihasvpn:
+    image: ghcr.io/coffey-labs/ihasvpn:latest
+    container_name: ihasvpn
     restart: unless-stopped
     cap_add:
       - NET_ADMIN
@@ -21,35 +21,35 @@ services:
       - net.ipv4.ip_forward=1
       - net.ipv4.conf.all.src_valid_mark=1
       # Loose reverse-path filtering; strict drops replies arriving on the
-      # tunnel. WGX would set this itself but /proc/sys is read-only in a
+      # tunnel. ihasvpn would set this itself but /proc/sys is read-only in a
       # container, so it has to come from here.
       - net.ipv4.conf.all.rp_filter=2
       - net.ipv4.conf.default.rp_filter=2
-      # Uncomment with WGX_SUBNET6 for IPv6 inside the tunnel.
+      # Uncomment with IHASVPN_SUBNET6 for IPv6 inside the tunnel.
       # - net.ipv6.conf.all.forwarding=1
       # - net.ipv6.conf.all.disable_ipv6=0
     environment:
       # The public hostname or IP clients connect to. Asked for at setup too.
-      WGX_ENDPOINT: vpn.example.com
+      IHASVPN_ENDPOINT: vpn.example.com
       # UDP port WireGuard listens on; must match the port mapping.
-      WGX_PORT: "51820"
+      IHASVPN_PORT: "51820"
       # Tunnel network. The server takes the first address.
-      WGX_SUBNET: 10.8.0.0/24
-      # WGX_SUBNET6: fd42:42:42::/64
+      IHASVPN_SUBNET: 10.8.0.0/24
+      # IHASVPN_SUBNET6: fd42:42:42::/64
       # DNS handed to clients by default.
-      WGX_DNS: 1.1.1.1, 1.0.0.1
+      IHASVPN_DNS: 1.1.1.1, 1.0.0.1
       # Admin UI. Put a TLS-terminating proxy in front of it, or enable the
       # built-in self-signed certificate, before exposing it anywhere but
       # localhost or your LAN.
-      WGX_HTTP_LISTEN: ":51821"
-      # WGX_TLS_SELF_SIGNED: "true"
-      # WGX_TRUSTED_PROXIES: 172.16.0.0/12
-      # WGX_METRICS_TOKEN: change-me
+      IHASVPN_HTTP_LISTEN: ":51821"
+      # IHASVPN_TLS_SELF_SIGNED: "true"
+      # IHASVPN_TRUSTED_PROXIES: 172.16.0.0/12
+      # IHASVPN_METRICS_TOKEN: change-me
     ports:
       - "51820:51820/udp"
       - "127.0.0.1:51821:51821/tcp"
     volumes:
-      - wgx-data:/data
+      - ihasvpn-data:/data
 
 volumes:
-  wgx-data:
+  ihasvpn-data: