refactor: hoist OS-specific package names to role defaults

- nfs_server: nfs_package_name (nfs-utils / nfs-kernel-server)
- wireguard: wireguard_package_name (wireguard-tools / wireguard)
- tooling:   tooling_dig_package, tooling_netcat_package

Also fix tooling role structure: move tooling.yml to tasks/main.yml so
the role is actually invokable via 'role: tooling' (defaults/main.yml
is auto-loaded), and collapse the 10 individual package tasks into a
single list-based install.

roles/wireguard/tasks/main.yml

@@ -11,7 +11,7 @@
 
 - name: Install wireguard
   ansible.builtin.package:
-    name: "{{ (ansible_facts['os_family'] == 'Archlinux') | ternary('wireguard-tools', 'wireguard') }}"
+    name: "{{ wireguard_package_name }}"
     state: present
 
 # Use systemd-resolved for DNS management (modern approach on all distributions)