The profile page now issues a VPN certificate for plant networks

The profile page has a new "VPN" tab, where "Issue cert" downloads a WireGuard configuration that reaches the networks of the plants a user has access to. "Reachable subnets" lists what the tunnel reaches, and "Recent connections" shows when it was last used.

• The configuration is shown only once, on issue and on rotation, and must be saved before the page is closed.
• When two plants offer the same subnet, one plant is chosen for it and the others stay attached but inactive.
• A subnet becomes reachable by itself once the plant's on-site agent can serve it.
• "Rotate cert" issues a new key and disconnects the current tunnel, while "Revoke cert" removes the certificate and connection history.

Release notes