fix(awg3): use fixed random H1-H4 instead of ranges

Ranged magic headers (min-max) are valid per spec, but with AWG 3.1
features enabled (HeaderProtectionKey, RandomTrailers, ...) current
clients fail to authenticate packets: the tunnel connects but degrades
to <1 Mbit/s with a flood of 'invalid mac1' errors. Fixed random values
work at full speed and keep header obfuscation per-deployment unique
(unlike the 1/2/3/4 defaults the AmneziaVPN app uses).

Refs: https://github.com/amnezia-vpn/amnezia-client/issues/3073

managers/awg_manager.py

@@ -457,7 +457,12 @@ iptables -C FORWARD -j DOCKER-USER 2>/dev/null || iptables -A FORWARD -j DOCKER-
         if awg_params is None:
             base_proto = self._base_protocol(protocol_type)
             awg_params = generate_awg_params(
-                use_ranges=(base_proto in (self.AWG, self.AWG2, self.AWG3)),
+                # Ranged H1-H4 ("min-max") are valid for AWG 2.0, but with AWG 3.1
+            # features (HeaderProtectionKey etc.) current clients fail to
+            # authenticate packets ("invalid mac1" flood, <1 Mbit/s). Until
+            # clients catch up, use fixed random magic headers for AWG 3.1.
+            # See https://github.com/amnezia-vpn/amnezia-client/issues/3073
+            use_ranges=(base_proto in (self.AWG, self.AWG2)),
                 awg3=(base_proto == self.AWG3),
             )