Function new_tunnel 

pub fn new_tunnel(
    mine: &WgKeypair,
    peer_public: PublicKey,
    index: u32,
) -> Result<Tunn, String>

Build a boringtun tunnel state machine for one peer.

A Tunn is a point-to-point WireGuard connection: mine is our static keypair, peer_public is the remote peer’s static public key, and index is a local session index (any u32; boringtun shifts it into the WireGuard sender-index space). This core deliberately keeps the tunnel plain — no preshared key, no persistent keepalive, and no shared rate limiter — so callers get a minimal, predictable state machine:

• preshared_key = None — optional psk2 layer left off; add later if a peer requires it.
• persistent_keepalive = None — the caller drives keepalives/timers explicitly.
• rate_limiter = None — Tunn builds its own default under-load limiter.

Tunn::new in 0.7.1 is infallible (returns Self), but we keep a Result signature so the public surface stays stable if a future boringtun revision makes construction fallible or we add validation (e.g. rejecting an all-zero peer key) here.