Update tora: userspace WireGuard VPN mode

torad --wireguard-config brings up a WireGuard tunnel entirely in user
space and confines all torrent traffic to it. No sudo, no wg-quick, no
kernel module, no host setup.

Adds passt, wireguard-go and iproute2 to the dev environment; torad
execs all three at runtime.

devenv.nix

@@ -39,6 +39,13 @@
     protoc-gen-tonic
     protoc-gen-prost
 
+    # torad VPN mode (--wireguard-config): pasta creates the unprivileged
+    # namespace, wireguard-go is the userspace datapath, `ip` configures the
+    # tunnel. See tora/devenv.nix for why wireguard-tools is not needed.
+    passt
+    wireguard-go
+    iproute2
+
     opencode
   ];