New CT 704 (ikev2.fr.egw, .140) and CT 706 (ikev2.gr.egw, .139) act as
IKEv2 responders for peers behind NAT (RPi/Free.fr and parentglobal/Cosmote)
that cannot accept inbound IKE. Peers initiate outbound; CT pins peer
outer-IP to provider gw via updown script so encapsulated ESP doesn't
loop through ipsec0 default. Docs updated; gateways added to web sidebar
and CHECK_GATEWAYS for proxy health probing.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>