Move Atlas management traffic to private WireGuard

Atlas now manages Metal hosts and service VMs only through WireGuard on the provider network; no management traffic on public addresses.