Add the shared packages for the sharks stack

model, tunnel, wg, authtoken, netguard, docker and dotenv, split out of the
original single repository so Hammerhead, Blacktip and Bamboo can live in
their own repos and import them. README extended; LICENSE unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

dotenv/dotenv_test.go

@@ -0,0 +1,61 @@
+package dotenv
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadParsesAndNeverOverridesTheRealEnvironment(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ".env")
+	os.WriteFile(path, []byte(`# a comment
+PLAIN=value one
+export EXPORTED=yes
+QUOTED="has # hash and \"quotes\"\nnewline"
+SINGLE='no $expansion \n here'
+TRAILING=kept # dropped
+EMPTY=
+ SPACED = trimmed
+BAD LINE
+=novalue
+ALREADY=from-file
+`), 0o600)
+	t.Setenv("ALREADY", "from-environment")
+	for _, k := range []string{"PLAIN", "EXPORTED", "QUOTED", "SINGLE", "TRAILING", "EMPTY", "SPACED"} {
+		os.Unsetenv(k)
+		defer os.Unsetenv(k)
+	}
+	used, err := Load(filepath.Join(dir, "missing.env"), path)
+	if err != nil || used != path {
+		t.Fatalf("Load = %q, %v", used, err)
+	}
+	want := map[string]string{
+		"PLAIN": "value one", "EXPORTED": "yes", "QUOTED": "has # hash and \"quotes\"\nnewline",
+		"SINGLE": `no $expansion \n here`, "TRAILING": "kept", "EMPTY": "", "SPACED": "trimmed", "ALREADY": "from-environment",
+	}
+	for k, v := range want {
+		if got, ok := os.LookupEnv(k); !ok || got != v {
+			t.Errorf("%s = %q (set=%v), want %q", k, got, ok, v)
+		}
+	}
+	if used, _ := Load(filepath.Join(dir, "nope")); used != "" {
+		t.Errorf("a missing file should load nothing, got %q", used)
+	}
+}
+
+func TestArgPath(t *testing.T) {
+	for _, tc := range []struct {
+		args []string
+		want string
+	}{
+		{[]string{"-listen", ":1"}, ".env"},
+		{[]string{"-env", "/etc/x.env"}, "/etc/x.env"},
+		{[]string{"--env=/a/b"}, "/a/b"},
+		{[]string{"-env"}, ".env"},
+	} {
+		if got := ArgPath(tc.args, ".env"); got != tc.want {
+			t.Errorf("ArgPath(%v) = %q, want %q", tc.args, got, tc.want)
+		}
+	}
+}