A peer that never connected has no timestamp, and names are readable

Two faults in the VPN tab, both found by running it against the real machines.

omitempty does nothing for a zero time.Time, so a peer that has never handshaken
was serialised as the year one and the page would have shown mbp14 as last seen
on 1 January 0001 instead of "never connected". The field is a pointer now, and
a test pins the JSON.

And peer names on a wg-quick host were never going to appear: /etc/wireguard is
root-only because it holds private keys, and the file was being opened as the
daemon's own user. It now falls back to reading it as root, the same way the
kernel state beside it is already read. Only comments and public keys are taken
from it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/vpn/vpn_test.go

@@ -1,8 +1,10 @@
 package vpn
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -48,11 +50,11 @@ func TestParseServerDump(t *testing.T) {
 	if p.Rx != 134192164 || p.Tx != 415977404 {
 		t.Errorf("counters = %d/%d", p.Rx, p.Tx)
 	}
-	if p.Handshake.Unix() != 1790565744 {
+	if p.Handshake == nil || p.Handshake.Unix() != 1790565744 {
 		t.Errorf("handshake = %v", p.Handshake)
 	}
 	// The second peer has never connected: no endpoint, no handshake, nothing moved.
-	if q := w.Peers[1]; q.Endpoint != "" || !q.Handshake.IsZero() || q.Rx != 0 {
+	if q := w.Peers[1]; q.Endpoint != "" || q.Handshake != nil || q.Rx != 0 {
 		t.Errorf("second peer = %+v, want one that has never been heard from", q)
 	}
 	if kind, exit := classify(w); kind != "server" || exit != "" {
@@ -149,3 +151,24 @@ func TestOnlineIsRecentHandshake(t *testing.T) {
 		}
 	}
 }
+
+// A peer that has never handshaken must carry no time at all, not the zero one. omitempty
+// does nothing for a time.Time, so this is the difference between the page saying "never
+// connected" and saying the device was last seen in the year one.
+func TestNeverConnectedHasNoTimestamp(t *testing.T) {
+	w := parseDump(gateDump)[0]
+	b, err := json.Marshal(w.Peers[1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(b), "handshake") {
+		t.Errorf("json = %s, want no handshake field at all", b)
+	}
+	if strings.Contains(string(b), "0001-01-01") {
+		t.Errorf("json = %s, want no year-one timestamp", b)
+	}
+	// and the one that has connected still carries its time
+	if b, _ := json.Marshal(w.Peers[0]); !strings.Contains(string(b), "handshake") {
+		t.Errorf("json = %s, want the handshake of a peer that has one", b)
+	}
+}