feat: modernize OpenVPN image — Alpine 3.20, tls-crypt, cleanup

[tomklapka]

Summary

• Pin Alpine base to 3.20 (was unpinned latest)
• Add tls-crypt support via -x flag / OVPN_TLS_CRYPT env var (replaces tls-auth for full control channel encryption)
• Add HEALTHCHECK instruction to Dockerfile
• Change EXPOSE from UDP to TCP (matches actual usage)
• Remove unused files: Dockerfile.aarch64, .travis.yml, alpine/ directory
• Update maintainer label

Breaking Changes

• tls-crypt mode (when -x flag is used) requires client config regeneration — tls-auth configs are not compatible with tls-crypt
• Without -x flag, behavior is unchanged (backward compatible)

Test plan

• Build image: docker build -t bonitoo/docker-openvpn:2.6.16 .
• Verify OpenVPN version: docker run --rm bonitoo/docker-openvpn:2.6.16 openvpn --version
• Test genconfig with tls-crypt: docker run --rm -v /tmp/test:/etc/openvpn bonitoo/docker-openvpn:2.6.16 ovpn_genconfig -u tcp://test:1194 -2 -x -d -b -N -n 10.43.0.10
• Verify tls-crypt in generated config: grep tls-crypt /tmp/test/openvpn.conf
• Verify OVPN_TLS_CRYPT=1 saved: grep TLS_CRYPT /tmp/test/ovpn_env.sh
• Test genconfig WITHOUT tls-crypt (backward compat): verify tls-auth in config
• Test getclient combined mode with tls-crypt: verify <tls-crypt> block in output
• Test getclient separated mode with tls-crypt: verify tls-crypt ta.key in output

🤖 Generated with Claude Code