feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung
- keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload)
- confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix)
- TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login
- Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator
- fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen
- VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034)
- Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032)
- unbound-control: edgeguard in unbound-Gruppe via postinst

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/dns.go

@@ -306,7 +306,7 @@ func (h *DNSHandler) UpdateSettings(c *gin.Context) {
 // cached RRs from the resolver. Useful after DNS propagation or when
 // stale records need to be evicted immediately.
 func (h *DNSHandler) FlushCache(c *gin.Context) {
-	out, err := exec.CommandContext(c.Request.Context(), "unbound-control", "flush_zone", ".").CombinedOutput()
+	out, err := exec.CommandContext(c.Request.Context(), "/usr/sbin/unbound-control", "flush_zone", ".").CombinedOutput()
 	if err != nil {
 		slog.Error("dns flush-cache failed", "err", err, "out", string(out))
 		response.Internal(c, err)
@@ -388,7 +388,7 @@ func validateZone(z *models.DNSZone) error {
 // stats_noreset liest die Zähler ohne sie zurückzusetzen — safe für
 // wiederholte Aufrufe aus dem UI.
 func (h *DNSHandler) Stats(c *gin.Context) {
-	out, err := exec.Command("unbound-control", "stats_noreset").Output()
+	out, err := exec.Command("/usr/sbin/unbound-control", "stats_noreset").Output()
 	if err != nil {
 		response.OK(c, gin.H{
 			"error": "unbound-control nicht verfügbar: " + err.Error(),