Documents the critical distinction between server-side (kernel routing table) and client-side (conf file) AllowedIPs to prevent the same bug from recurring. Server-side: always InternalIP/32 per peer. Client-side: use EndpointAllowedIPs from DB.