Refine WireGuard client routing and authentication UI

frontend/src/locales/en-US.json

@@ -129,6 +129,10 @@
     "noTunnels": "No tunnels yet",
     "expireTime": "Expiry Time",
     "localNode": "Local",
+    "authMethod": "Authentication",
+    "authUnknown": "Unspecified",
+    "wgAuthPassword": "Client account + device key",
+    "wgAuthHint": "The client account obtains device authorization; WireGuard authenticates using keys. Manually added static peers still connect by key.",
     "start": "Start",
     "stop": "Stop",
     "started": "Started",
@@ -768,6 +772,14 @@
           "label": "Server VPN Subnet Address",
           "tip": "Server's address within the VPN subnet (CIDR)"
         },
+        "auth_mode": {
+          "label": "Client Authentication",
+          "tip": "Account login grants a device; the tunnel uses key authentication. Static peers still connect by key. Browser OIDC requires a client callback and explicit user grants.",
+          "options": {
+            "password": "Client account + device key",
+            "oidc": "Third-party OAuth2 / OIDC (not available yet)"
+          }
+        },
         "listen_port": {
           "label": "Listen Port"
         },
@@ -786,6 +798,10 @@
           "label": "Client AllowedIPs",
           "tip": "Use 0.0.0.0/0 for full tunnel; specify internal CIDRs for split tunnel"
         },
+        "latency_probe": {
+          "label": "Tunnel probe target",
+          "tip": "Reachable IP:port through this line, e.g. 10.88.0.1:22; defaults to 223.5.5.5:443. Measures TCP setup time."
+        },
         "keepalive": {
           "label": "Keepalive (sec)",
           "tip": "Recommended 15–25 for clients behind NAT"