fn derive_secret(role: &str, pass: &str) -> [u8; 32]
Derive a deterministic 32-byte WireGuard secret from (role, passphrase).
(role, passphrase)