Description
## Problem
Migrating the WireGuard hub to a new server is manual and error-prone: copy mesh.yaml, copy hub.key, update DNS, wait for peers to re-resolve. Peers with cached DNS (especially Windows) take 10+ minutes or require manual tunnel restarts.
## Fix
Add `hydraguard hub migrate` command that:
1. Exports full hub state (mesh.yaml, hub.key, api.yaml)
2. Imports on the new hub
3. Generates wg0.conf and starts WireGuard
4. Optionally triggers peer re-resolve via hydracluster exec (restart tunnel service on Windows bodies)
## Files
- Hydraguard repo: new `hub migrate` CLI command