feat: add WireGuard Waybar custom module

- Added scripts/wireguard-status.sh — JSON output with lock/unlock icons,
  human-readable TX/RX stats, tooltip with peer/endpoint/IP details
- Added custom/wireguard module to Waybar modules.json (10s interval, JSON
  return type, click left/right for up/down)
- Added custom/wireguard to modules-right bar config
- Added CSS for #custom-wireguard (connected/disconnected classes)
- Added openresolv install and Waybar refresh instructions to README.org

README.org

@@ -17,6 +17,42 @@ I use stow to deploy all this to where it need to go (mostly ~/.confg).
 ** starship
 ** tmux
 ** waybar
+*** WireGuard Module
+The Waybar includes a custom WireGuard VPN status module that shows connection status, TX/RX stats, and peer info.
+
+Setup:
+
+1. Install openresolv (needed by wg-quick for DNS):
+   #+begin_src bash :tangle no
+   sudo pacman -S openresolv
+   #+end_src
+
+2. Configure sudo for wg-quick (required for click-to-toggle binds):
+   #+begin_src bash :tangle no
+   echo "$USER ALL=(ALL) NOPASSWD: /usr/bin/wg-quick" | sudo tee /etc/sudoers.d/wireguard
+   #+end_src
+
+3. Create a WireGuard config (if not exists):
+   #+begin_src bash :tangle no
+   sudo cp /etc/wireguard/work-laptop.conf /etc/wireguard/
+   sudo chmod 600 /etc/wireguard/work-laptop.conf
+   #+end_src
+
+4. Refresh Waybar to pick up new config:
+   #+begin_src bash :tangle no
+   killall -q waybar && waybar -c ~/.config/waybar/config.jsonc & -s ~/.config/waybar/style.css &
+   #+end_src
+
+Or use the launch script:
+   #+begin_src bash :tangle no
+   ~/.config/waybar/launch.sh
+   #+end_src
+
+Keybinds:
+- ~$mainMod+Ctrl+V~ — Connect WireGuard (work-laptop)
+- ~$mainMod+Ctrl+Shift+V~ — Disconnect WireGuard
+
+The module polls /usr/bin/wg every 10 seconds. It shows a lock icon with TX/RX when connected, or an unlock icon when disconnected.
 ** Wireplumber
 ** wofi
 ** yazi