luci-proto-wireguard: add tunlink option

The WireGuard protocol handler passes the tunlink option to netifd as
the interface to create the host routes to the peer endpoints on
(proto_add_host_dependency). Without it, netifd uses the interface with
the most specific route to the endpoint, which is not always the
intended uplink, e.g. with several WAN interfaces or other VPNs.

LuCI has no field for it, so it can only be set with uci. Add it as
"Underlying interface", next to "No Host Routes".

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Erik Conijn <egc112@msn.com>

protocols/luci-proto-wireguard/htdocs/luci-static/resources/protocol/wireguard.js

@@ -8,6 +8,7 @@
 'require network';
 'require validation';
 'require uqr';
+'require tools.widgets as widgets';
 
 var generateKey = rpc.declare({
 	object: 'luci.wireguard',
@@ -160,6 +161,11 @@ return network.registerProtocol('wireguard', {
 		o = s.taboption('general', form.Flag, 'nohostroute', _('No Host Routes'), _('Optional. Do not create host routes to peers.'));
 		o.optional = true;
 
+		o = s.taboption('general', widgets.NetworkSelect, 'tunlink', _('Underlying interface'), _('Optional. Create the host routes to peers via this interface. If empty, the interface with the most specific route to the peer endpoint is used, usually the WAN. It must have a route for the address family of the peer endpoints.'));
+		o.exclude = s.section;
+		o.nocreate = true;
+		o.optional = true;
+
 		o = s.taboption('general', form.Button, '_import', _('Import configuration'), _('Imports settings from an existing WireGuard configuration file'));
 		o.inputtitle = _('Load configuration…');
 		o.onclick = function() {