The site agent: a WireGuard peer that dials out to each edge, accepts TCP streams and native UDP datagrams inside the tunnel, lists local Docker containers, and runs the local SMTP relay for mail egress. Split out of the original single repository; depends on Reef for the shared types. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>