feat: add installer script and builder tools

- Added install.sh for easy setup and teardown
- Added build.sh and build.bat to dynamically assemble install.sh
- Updated README.md with new installation instructions
- Fixed bidirectional WG_POLICY FORWARD rule routing in wg-policy-engine.sh

wg-policy-engine.sh

@@ -111,12 +111,6 @@ main() {
         sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1 || true
     fi
 
-    # Allow return traffic to wg interface
-    if ! iptables -C FORWARD -o "$WG_IF" -j ACCEPT 2>/dev/null; then
-        iptables -I FORWARD 1 -o "$WG_IF" -j ACCEPT
-        log_info "Added FORWARD rule for return traffic to $WG_IF"
-    fi
-
     # Setup MASQUERADE on default interface
     if ! iptables -t nat -C POSTROUTING -o "$DEF_IF" -j MASQUERADE 2>/dev/null; then
         iptables -t nat -A POSTROUTING -o "$DEF_IF" -j MASQUERADE
@@ -151,9 +145,13 @@ main() {
     iptables -N "$CHAIN"
 
     if ! iptables -C FORWARD -i "$WG_IF" -j "$CHAIN" 2>/dev/null; then
-        iptables -A FORWARD -i "$WG_IF" -j "$CHAIN"
+        iptables -I FORWARD 1 -i "$WG_IF" -j "$CHAIN"
     fi
-    log_info "Chain $CHAIN created and linked to FORWARD"
+    
+    if ! iptables -C FORWARD -o "$WG_IF" -j "$CHAIN" 2>/dev/null; then
+        iptables -I FORWARD 2 -o "$WG_IF" -j "$CHAIN"
+    fi
+    log_info "Chain $CHAIN created and linked to FORWARD (In/Out)"
 
     # === POPULATE IPSET (hash:net,net for source->target mapping) ===
     local use_ipset=false