chore: move semi-secrets to separate flake

feat: make sure dhcp won't change dns

fix: move wireguard private key somewhere out of user config, to make sure config won't be created by root

feat: add dns servers through wireguard

feat: add wireguard