Raise the overlay MTU to 1280: below that Linux disables IPv6

The setup recipe failed with a missing sysctl directory and "RTNETLINK
answers: Invalid argument". The cause was the default MTU of 1100.

IPv6 requires a minimum MTU of 1280 (RFC 8200) and Linux enforces it by
tearing IPv6 down on any interface below it: the per-device
/proc/sys/net/ipv6/conf entries disappear and an address can no longer be
assigned. Evidence on the test host: every interface at 1280 or above has
an IPv6 conf directory, every interface below it (1230, 1100) has none.

So the overlay MTU is now 1280, which is also the floor. A smaller value is
refused when the plugin opens, naming the reason, rather than surfacing as
an obscure netlink error after the user has already run four commands.

That leaves no slack against the other constraint: a packet needs mtu + 32
bytes of transport datagram, so 1312. A direct QUIC path offers roughly
1380 and fits; a relayed path may not, so the plugin now reports the exact
numbers when a link cannot carry a full-size packet, instead of only
counting silent drops.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/wireguard.md

@@ -101,12 +101,24 @@ than silent non-connectivity.
 
 ## MTU
 
-Every packet rides in one transport datagram, and WireGuard adds 32 bytes. A
-QUIC datagram on a relayed path can be as small as roughly 1160 bytes, so the
-default interface MTU is **1100**, which leaves headroom rather than relying on
-the best case. Packets that do not fit are dropped and counted
-(`dropped_oversize`), never truncated. The observed datagram limit of each link
-is reported in the status output.
+Two constraints pull against each other.
+
+**IPv6 sets a floor of 1280 bytes** (RFC 8200), and Linux enforces it
+brutally: an interface whose MTU drops below 1280 loses IPv6 entirely — its
+`/proc/sys/net/ipv6/conf/<dev>` directory disappears and `ip -6 address add`
+answers `Invalid argument`. So the overlay MTU cannot go below 1280, and the
+plugin refuses a smaller one at startup instead of letting it fail obscurely.
+
+**The transport sets a ceiling.** Every packet rides in one datagram and
+WireGuard adds 32 bytes, so a link must carry `mtu + 32` = 1312 bytes. A direct
+QUIC path typically offers around 1380, which fits. A relayed path can offer
+less, and then full-size packets do not fit: they are dropped and counted as
+`dropped_oversize`, never truncated, and the plugin reports the exact numbers
+when the tunnel is set up.
+
+There is no room left to trade, so the default MTU is exactly 1280.
+Fragmenting a packet across several datagrams would lift the ceiling and is
+not implemented.
 
 ## Lifecycle