cli: avoid data-dir initialization for version; create db parent dirs; redact generated passwords in CLI output

- Prevent 'nx9-wg version' from creating data directories by avoiding database initialization.
- Create parent directories when an explicit --database path is provided.
- Redact printed generated administrator passwords; announce file path or redact instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

crates/nx9-wg-db/migrations/0002_wiregui_capabilities.sql

@@ -0,0 +1,7 @@
+-- 0002_wiregui_capabilities.sql
+-- Add peer-specific firewall association and structured port semantics
+
+ALTER TABLE firewall_rules ADD COLUMN peer_id TEXT REFERENCES peers(id) ON DELETE CASCADE;
+ALTER TABLE firewall_rules ADD COLUMN port_range TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_firewall_peer_id ON firewall_rules(peer_id);