feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung
- keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload)
- confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix)
- TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login
- Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator
- fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen
- VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034)
- Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032)
- unbound-control: edgeguard in unbound-Gruppe via postinst

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/keepalived/keepalived.conf.tpl

@@ -2,8 +2,6 @@ global_defs {
     router_id {{ .RouterID }}
     script_user root
     enable_script_security
-    vrrp_garp_interval 0
-    vrrp_gna_interval 0
 }
 
 vrrp_script chk_edgeguard {
@@ -13,7 +11,23 @@ vrrp_script chk_edgeguard {
     fall 3
     rise 2
 }
-
+{{ if .GWCheckIP }}
+vrrp_script chk_gateway {
+    script "/usr/lib/edgeguard/keepalived-gw-check.sh {{ .GWCheckIP }}"
+    interval 5
+    weight -110
+    fall 2
+    rise 2
+}
+{{ end }}
+{{ if .HBInterface }}
+vrrp_sync_group VG_1 {
+    group {
+        VI_1
+        VI_HB
+    }
+}
+{{ end }}
 vrrp_instance VI_1 {
     state {{ .State }}
     interface {{ .Interface }}
@@ -29,12 +43,30 @@ vrrp_instance VI_1 {
         auth_pass {{ .AuthPass }}
     }
     virtual_ipaddress {
-        {{ .VIP }}
-    }
+{{ range .VIPs }}        {{ .Address }}/{{ .Prefix }} dev {{ .Device }}
+{{ end }}    }
     track_script {
         chk_edgeguard
-    }
+{{ if .GWCheckIP }}        chk_gateway
+{{ end }}    }
     notify_master  "/usr/lib/edgeguard/keepalived-master.sh"
     notify_backup  "/usr/lib/edgeguard/keepalived-backup.sh"
     notify_fault   "/usr/lib/edgeguard/keepalived-backup.sh"
 }
+{{ if .HBInterface }}
+vrrp_instance VI_HB {
+    state {{ .State }}
+    interface {{ .HBInterface }}
+    virtual_router_id {{ .HBRouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .HBSrcIP }}    unicast_src_ip {{ .HBSrcIP }}
+    unicast_peer {
+        {{ .HBPeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+}
+{{ end }}