Pevnost VPN for Windows, 0.2.1-beta (self-contained)
=====================================================

1. Unzip the whole folder somewhere permanent (for example C:\Program Files\Pevnost or your Documents).
   Keep Pevnost.exe, tunnel.dll and wireguard.dll together: the app loads both DLLs from its own folder.
   You do NOT need WireGuard for Windows installed.

2. Run Pevnost.exe. Windows asks for administrator rights (UAC): the app needs them to install the
   tunnel service and the WireGuardNT network driver on first connect.

3. SmartScreen: the binary is not code-signed yet, so Windows shows "Windows protected your PC".
   Click "More info" -> "Run anyway" only after verifying the SHA-256 of the zip against
   https://pevnost.net/download :  PowerShell:  Get-FileHash .\Pevnost-0.2.1-beta-windows-amd64.zip

What happens when you connect
-----------------------------
- The app writes the tunnel configuration to C:\ProgramData\Pevnost\pevnost.conf (readable only by
  SYSTEM and Administrators) and creates a Windows service "WireGuardTunnel$pevnost" that runs
  Pevnost.exe /service with that file. The service is the same tunnel code as the official WireGuard
  client (tunnel.dll). Because the tunnel routes everything (0.0.0.0/0, ::/0), it also installs the
  firewall kill switch: while the tunnel is up, traffic outside the tunnel and non-tunnel DNS are blocked.
- Disconnect stops and removes the service and deletes the configuration file. The private key stays
  only in your DPAPI-protected app state.
- Tunnel log (binary ring log, readable with WireGuard tooling): C:\ProgramData\Pevnost\log.bin

Uninstall
---------
Disconnect in the app, close it, delete the folder. Optional driver removal:
  pnputil /enum-drivers  (look for wireguard.inf)  then  pnputil /delete-driver oemNN.inf /uninstall

Third-party components: see THIRD-PARTY-LICENSES.txt.
