fix: make ipset optional, fix ExecStartPre, add prerequisites to README

wg-policy-lib.sh

@@ -129,8 +129,13 @@ validate_cidr() {
 # IPSET MANAGEMENT
 # ============================================================
 
+has_ipset() {
+    command -v ipset &>/dev/null
+}
+
 ensure_ipset() {
     local name="$1" family="$2"
+    has_ipset || return 0
     if ! ipset list "$name" &>/dev/null; then
         ipset create "$name" hash:net family "$family" hashsize 1024 maxelem 65536 timeout 0
         log_info "Created ipset: $name (family=$family)"
@@ -139,6 +144,7 @@ ensure_ipset() {
 
 flush_ipset() {
     local name="$1"
+    has_ipset || return 0
     if ipset list "$name" &>/dev/null; then
         ipset flush "$name"
     fi
@@ -146,6 +152,7 @@ flush_ipset() {
 
 destroy_ipset() {
     local name="$1"
+    has_ipset || return 0
     if ipset list "$name" &>/dev/null; then
         ipset destroy "$name"
     fi