feat: manual connect mode + env -i sudo wrapper to fix pkg bootstrap crash

- MANUAL_CONNECT=true: container waits for tun0, user connects via docker exec
- MANUAL_CONNECT=false: auto mode (current), now with env -i in sudo wrapper
- sudo wrapper logs inherited env key names so we can see what parent injects
- monitor_loop extracted as shared function used by both modes
- auto mode connect logic cleaned up into a single while-true rotation loop

vpn-node/Dockerfile

@@ -35,11 +35,12 @@ RUN echo "=== binary type ===" \
     && echo "=== bin/purevpn-cli header ===" \
     && head -3 /opt/purevpn-cli/bin/purevpn-cli 2>/dev/null || true
 
-# ── Fake sudo — last-resort safety net ───────────────────────────────────────
-# If purevpn-cli still calls sudo despite the stub above, this wrapper runs
-# the command minus --install-missing-components so it doesn't crash the
-# pkg/Node.js bootstrap. The echo lets us see in logs if it fires.
-RUN printf '#!/bin/bash\nnew=()\nfor a in "$@"; do\n  [[ "$a" == "--install-missing-components" ]] && { echo "[sudo] stripped --install-missing-components"; continue; }\n  new+=("$a")\ndone\necho "[sudo] exec: ${new[*]}"\nexec "${new[@]}"\n' \
+# ── Fake sudo wrapper ────────────────────────────────────────────────────────
+# Strips --install-missing-components (crashes pkg bootstrap when combined with
+# --connect) then re-runs the binary with a CLEAN environment (env -i) so that
+# any env vars set by the parent purevpn-cli don't corrupt the child's pkg
+# bootstrap. Prints env key names and exec'd command for diagnosis.
+RUN printf '#!/bin/bash\necho "[sudo] env: $(env | cut -d= -f1 | tr "\\n" " ")"\nnew=()\nfor a in "$@"; do\n  [[ "$a" == "--install-missing-components" ]] && { echo "[sudo] stripped --install-missing-components"; continue; }\n  new+=("$a")\ndone\necho "[sudo] exec (clean env): ${new[*]}"\nexec env -i PATH="$PATH" HOME=/root USER=root "${new[@]}"\n' \
     > /usr/local/bin/sudo && chmod +x /usr/local/bin/sudo
 
 # ── PATH ──────────────────────────────────────────────────────────────────────