wireguard: fix wizard Download button unusable behind wait overlay

[ispyisail]

Summary

• Found while building the vnet phase 52/54 regression tests for the wizards (PR wireguard: add a Remote Access Setup Wizard #146/wireguard: add Guest Party Mode #148): step 3's / the guest party done panel's Download Config File button rendered under setControlsEnabled(false)'s wait overlay, which stays up until saveChanges()'s own 5-second-later auto-reload — the overlay blocked every click for the whole window, and the reload then wiped the wizard modal out. Confirmed live with a real browser: the button was never actually clickable.
• saveChanges() now takes an optional completion callback (every other caller passes nothing, unaffected); the wizards' step3/done/ended handlers are passed as that callback instead of being called unconditionally right after saveChanges() returns, and those handlers clear the overlay themselves once the real backend commit has landed.
• This also closes a second, subtler race: showing the button immediately (rather than once the backend commit lands) let a fast Download click's own run_commands.sh call overlap saveChanges()'s still in-flight one, both serialized behind the same server-side lock, occasionally producing a 0-byte config download.
• Follow-up commit: the overlay fix alone wasn't sufficient — saveChanges()'s 5-second auto-reload timer keeps running regardless of the callback, so a user who takes longer than ~5s to finish interacting with the wizard (confirmed live with Guest Party Mode's add-a-second-guest flow) still gets the modal wiped out mid-interaction. saveChanges() now takes a deferReload flag; the three wizard call sites set it and fire the reload themselves only when their own Done button is clicked, not on a fixed timer. Also fixed guestPartyEnd()'s completion callback, which was missing the same setControlsEnabled(true) call the other two handlers already had.

Test plan

• node --check on the modified file
• Full tests/wireguard/*.test.js jsdom suite: 83/83 green
• Live-verified against a real browser (Playwright) + real vnet router: both wizards' Download buttons clickable immediately and reliably, correct config content, multi-step flows (Guest Party's Add Another, End) all complete without the modal being wiped out
• New vnet phases 52 and 54 (gargoyle-tools repo) exercise both wizards end-to-end, each run clean twice in a row