installer: new installs default to AmneziaWG 3.1 and fall back to 2.0 where 3.1 cannot run (#337)

A new install without --protocol now gets AmneziaWG 3.1. On a machine
where 3.1 cannot run and the generation was not chosen, the installer
installs 2.0 by itself and says why in a block that is the same
interactively and under --yes. An explicit --protocol=3.1 on such a
machine still stops with the reason code. --protocol=2.0 keeps installing
2.0. Existing installs keep their generation: a server without a
generation marker reads as 2.0, as before.

3.1 gives way to 2.0 at step 0 for the architecture (ARM, anything that
is not x86_64) and the kernel (older than 6.7, Debian 12), and at step 3
for the installed tools and the loaded module. At step 3 the installer
generates one 2.0 parameter set with the saved Jc/Jmin/Jmax and preset
(--jc=0, --preset=mobile and --no-cps carry over), applies exactly that
set to a temporary interface, reads it back, and only then rewrites the
settings file. If the module refuses the set, the install stops with the
settings file untouched. A 2.0 set saved by the step 0 fallback is probed
the same way at step 3, before any key is made.

An install that has reached step 6 (server keys, configs, profiles or a
live awg0) is never downgraded, checked at step 0 of the same run and
again right before the fallback. Step 6 hands out 3.1 profiles only after
the step 3 check passed in the same run, and never falls back. An
existing 3.1 server that no longer passes the check is told the reason
and a repair that leaves it alone; removal is named only as the last
resort, and a failure of the check itself is reported as an installer
error, not as a reason to remove anything.

The settings file gets two new keys, AWG_PROTOCOL_SOURCE (default or
explicit) and AWG_PROTOCOL_FALLBACK (the reason code). The settings
writer moved into its own function unchanged, so step 0 and step 3 share
it. A short notice before step 1 says the default is 3.1 and who should
rerun with --protocol=2.0; the final report names the generation, the
fallback reason if any, and the clients 3.1 needs; --help describes the
default and the fallback.

The README DeepWiki badge is served from docs/badges/deepwiki.svg, since
deepwiki.com/badge.svg answers automated clients with a 429 and the
GitHub image proxy showed a broken image.

docs/badges/deepwiki.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="90" height="20" role="img" aria-label="Ask: DeepWiki"><title>Ask: DeepWiki</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="90" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="29" height="20" fill="#555"/><rect x="29" width="61" height="20" fill="#1f6feb"/><rect width="90" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="155" y="150" fill-opacity=".8" filter="url(#blur)" textLength="190">Ask</text><text x="155" y="150" fill-opacity=".3" textLength="190">Ask</text></g><text x="155" y="140" textLength="190">Ask</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="585" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">DeepWiki</text><text x="585" y="150" fill-opacity=".3" textLength="510">DeepWiki</text></g><text x="585" y="140" textLength="510">DeepWiki</text></g></g></svg>