Add gluetun endpoint watcher (5-minute systemd timer)

When gluetun is unhealthy, re-dig the WireGuard peer hostname, update
wg0.conf Endpoint, recreate gluetun then qbittorrent, and verify the
VPN exit IP. Keeps torrent path alive when provider endpoints rotate.

ansible/group_vars/all.yml

@@ -186,6 +186,10 @@ ufw_lan_tcp_ports:
   - { port: 3002, comment: "Forgejo HTTP" }
   - { port: 2222, comment: "Forgejo Git SSH" }
 
+# WireGuard peer hostname for gluetun-endpoint-watch
+wireguard_endpoint_host: las-183-wg.whiskergalaxy.com
+wireguard_endpoint_port: "443"
+
 # Forgejo (self-hosted Git)
 forgejo_domain: "192.168.8.123"
 forgejo_http_port: 3002