feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung
- keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload)
- confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix)
- TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login
- Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator
- fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen
- VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034)
- Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032)
- unbound-control: edgeguard in unbound-Gruppe via postinst

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/squid/squid.cfg.tpl

@@ -2,12 +2,14 @@
 # Source: internal/squid/squid.go (template: squid.cfg.tpl).
 # Re-generate via `edgeguard-ctl render-config --only=squid`.
 
-http_port {{.ListenPort}}
+{{range .ListenAddrs -}}
+{{if .Addr}}http_port {{.Addr}}:{{.Port}}
+{{else}}http_port {{.Port}}
+{{end}}{{- end}}
 
-# Standard cache directory + small in-memory cache. Forward proxy
-# isn't a CDN — we keep cache modest to avoid disk pressure.
-cache_dir ufs /var/spool/squid 100 16 256
-cache_mem 64 MB
+cache_dir ufs /var/spool/squid {{.CacheDirMB}} 16 256
+cache_mem {{.CacheMemMB}} MB
+maximum_object_size {{.MaxObjSizeMB}} MB
 
 # Logging — combined access log, rotated by logrotate.
 access_log /var/log/squid/access.log squid
@@ -56,7 +58,9 @@ http_access allow localhost
 http_access allow localnet
 http_access deny all
 
-# Hostnames + visible name — operator can override via squid.conf
-# drop-in if needed.
+connect_timeout {{.ConnectTimeout}} seconds
+read_timeout {{.ReadTimeout}} seconds
+request_timeout {{.RequestTimeout}} seconds
+
 visible_hostname edgeguard-proxy
 forwarded_for on