docs: update AGENTS.md and README.md for WGRplane integration

- Add WGRplane component documentation to AGENTS.md
- Update README.md with combined WireGuard Policy + WGRplane docs
- Fix .gitignore (remove .gitea/ from ignore)

AGENTS.md

@@ -1,4 +1,12 @@
-# WireGuard Policy Firewall (`03.wireguard-policy`)
+# WireGuard Policy Firewall + WGRplane (`03.wireguard-policy`)
+
+This repository contains two components:
+1. **WireGuard Policy Firewall** - Shell script-based dynamic iptables/ipset policy engine
+2. **WGRplane** - Go-native control plane with Vue 3 frontend
+
+---
+
+## Component 1: WireGuard Policy Firewall
 
 ## Architecture & Configuration Flow
 - **Goal:** Dynamic iptables/ipset rules based on WireGuard configuration (`wg0.conf`).
@@ -25,3 +33,72 @@
 ## Development Commands
 - Restart the watcher service: `systemctl restart wg-policy.service`
 - Check service logs: `journalctl -u wg-policy.service -f`
+
+---
+
+## Component 2: WGRplane (Go App in `/app`)
+
+## Architecture Overview
+WGRplane is a Go-native WireGuard control plane application with a Vue 3 frontend, providing a modern web dashboard for WireGuard management.
+
+- **Single Binary:** The Go binary (`app/main.go`) serves both the REST API (port 10087) and the built Vue frontend from `app/frontend/dist/`.
+- **Hybrid Mode:**
+  - `forward` - Directly applies nftables rules on the local machine
+  - `standalone` - Acts as a control plane that triggers webhooks to remote WireGuard servers
+- **2-Column Policy:** Each peer has `AllowAccess` (CIDR whitelist) and `AllowInternet` (boolean toggle)
+
+## Key File Locations
+- `app/main.go` - Bootstrap server, routing, init DB
+- `app/handlers.go` - REST API route handlers
+- `app/models.go` - GORM models (Server, Peer, Webhook, SMTP)
+- `app/auth.go` - JWT, TOTP, API key auth middleware
+- `app/nftables.go` - nftables rule management (mode forward)
+- `app/webhook.go` - Webhook engine with retry/backoff
+- `app/scheduler.go` - Cron jobs (expiry, data limit, reset)
+- `app/stats.go` - WebSocket Hub for real-time stats
+- `app/frontend/` - Vue 3 SPA (TypeScript, TailwindCSS 4)
+
+## Tech Stack
+| Component | Technology |
+|-----------|------------|
+| **Backend** | Go, Gorilla Mux, GORM (SQLite via glebarez/sqlite) |
+| **Frontend** | Vue 3, TypeScript, Vite, TailwindCSS 4, vue-i18n 9 |
+| **Auth** | JWT (golang-jwt/v5), TOTP (pquerna/otp), API Key |
+| **WebSockets** | gorilla/websocket |
+| **Webhooks** | Go net/http with retry + exponential backoff |
+| **Scheduling** | robfig/cron v3 |
+| **QR Code** | skip2/go-qrcode |
+| **Email** | jordan-wright/email (SMTP) |
+
+## Authentication Methods
+WGRplane supports three authentication methods:
+
+| Method | Header | Notes |
+|--------|--------|-------|
+| API Key | `wg-rplane-datadunia: <KEY>` | Set via env var `WG_API_KEY`. Default: `test-api-key` |
+| JWT | `Authorization: Bearer <TOKEN>` | Expires in 15 minutes. Secret via env var `JWT_SECRET` |
+| TOTP | `X-TOTP: <CODE>` | Required if user enables TOTP |
+
+## Development Commands
+- Build Go binary: `cd app && go build -o ../wgrplane .`
+- Build frontend: `cd app/frontend && npm install && npm run build`
+- Run locally: `./wgrplane` (serves on `http://localhost:10087`)
+- Restart service: `systemctl restart wgrplane.service`
+- Check service logs: `journalctl -u wgrplane.service -f`
+
+## Testing & Verifying
+- Test auth (no header): `curl http://localhost:10087/api/servers` (expect 401)
+- Test auth (correct): `curl -H "wg-rplane-datadunia: test-api-key" http://localhost:10087/api/servers`
+- View Swagger docs: Visit `http://localhost:10087/swagger/`
+- WebSocket test: Connect to `ws://localhost:10087/ws/stats`
+
+## References
+- For detailed WGRplane documentation: See `app/README.md`
+- For WGRplane-specific AI agent guidance: See `app/AGENTS.md`
+
+---
+
+## Notes for AI Agents
+- The `.sisyphus/` directory contains planning artifacts and may be cleaned up after plan completion.
+- When working on Policy Firewall scripts, always preserve `#Access` comment parsing logic.
+- When working on WGRplane, remember it's a single binary serving both API and frontend on port 10087.