Refine WireGuard client routing and authentication UI

backend/internal/service/wireguard/wireguard.go

@@ -106,6 +106,11 @@ func isWireGuardKey(key string) bool {
 }
 
 func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
+	// Static peers still authenticate by their key; this setting only describes
+	// how the managed desktop client obtains its device grant.
+	if mode := service.Str(cfg, "auth_mode"); mode != "" && mode != "password" {
+		return nil, fmt.Errorf("WireGuard 尚不支持第三方 OAuth2/OIDC 登录，请使用客户端账号与设备密钥")
+	}
 	if err := service.MustValidate(cfg, "address"); err != nil {
 		return nil, err
 	}
@@ -127,6 +132,13 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 	if err := validateCIDRList(service.Str(out, "allowed_ips")); err != nil {
 		return nil, fmt.Errorf("allowed_ips: %w", err)
 	}
+	if target := service.Str(out, "latency_probe"); target != "" {
+		host, port, err := net.SplitHostPort(target)
+		probePort, parseErr := strconv.Atoi(port)
+		if err != nil || parseErr != nil || net.ParseIP(host) == nil || probePort < 1 || probePort > 65535 {
+			return nil, fmt.Errorf("latency_probe 必须是可经 VPN 访问的 IP:端口")
+		}
+	}
 	if service.Str(out, "dns") == "" {
 		out["dns"] = service.DefaultDNS()
 	}