Add the Bamboo site agent

The site agent: a WireGuard peer that dials out to each edge, accepts TCP
streams and native UDP datagrams inside the tunnel, lists local Docker
containers, and runs the local SMTP relay for mail egress. Split out of the
original single repository; depends on Reef for the shared types.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/bamboo/main.go

@@ -0,0 +1,46 @@
+// Bamboo is the site agent: run it inside a private network to expose services from there.
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"os"
+	"os/signal"
+	"strings"
+
+	"git.veillax.com/Veillax/bamboo"
+	"git.veillax.com/Veillax/reef/dotenv"
+)
+
+func env(k, def string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return def
+}
+
+func main() {
+	// secrets (tokens, DNS-provider credentials) can live in a .env file instead of the command line
+	envFile := dotenv.ArgPath(os.Args[1:], ".env")
+	if _, err := dotenv.Load(envFile); err != nil {
+		log.Fatalf("read %s: %v", envFile, err)
+	}
+	hh := flag.String("hammerhead", env("BAMBOO_HAMMERHEAD", ""), "URL of hammerhead")
+	token := flag.String("token", env("BAMBOO_TOKEN", ""), "site token from the hammerhead UI")
+	data := flag.String("data", env("BAMBOO_DATA", "./bamboo-data"), "directory for this agent's WireGuard key")
+	dockerOn := flag.Bool("docker", os.Getenv("BAMBOO_DOCKER") == "1", "report local Docker containers so they can be picked as targets in the UI")
+	flag.String("env", ".env", "file to read secrets and settings from")
+	flag.Parse()
+	if *hh == "" || *token == "" {
+		flag.Usage()
+		os.Exit(2)
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer stop()
+	b, err := bamboo.New(bamboo.Config{Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, DataDir: *data, Docker: *dockerOn})
+	if err != nil {
+		log.Fatal(err)
+	}
+	b.Run(ctx)
+}