Follow-up: polish wg codec after #108 (errors, tests, certhash consistency)

[acul71]

Context

PR #108 merged draft WireGuard (wg) support with multibase base64url (u prefix). Library behavior is correct; this tracks non-blocking improvements identified in review (including the fable pass on 8be3a8b / post-merge head).

Upstream spec registration stays in #123 — this issue is code/tests only.

Suggested scope

• Clearer errors for pasted wg(8) keys — std-base64 that starts with u, padded u…=, etc. should hint at the docstring conversion path (base64 → multibase.encode('base64url', …)) instead of opaque multibase decode failures.
• Align with certhash validation pattern — route length checks through self.validate(); use ValueError from to_string where appropriate to avoid double-wrapped BinaryParseError on edge calls.
• Negative test coverage — u!!!, u-prefixed body containing +; optional invalid Multiaddr vector with + in the wg segment.
• Optional: shared multibase base64url helper with certhash (dedup + narrower exception handling).
• Optional nits: dedupe duplicate roundtrip tests; fixed byte patterns instead of os.urandom in length/validate tests; docstring ascii vs utf-8 align.

References

• PR Add wg (WireGuard) protocol support #108 (merged)
• Review thread: Add wg (WireGuard) protocol support #108 (comment)
• Author fable review: Add wg (WireGuard) protocol support #108 (comment)

Notes

None of the above blocked merge; tackle as a small follow-up PR when convenient.