feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung
- keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload)
- confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix)
- TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login
- Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator
- fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen
- VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034)
- Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032)
- unbound-control: edgeguard in unbound-Gruppe via postinst

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/wireguard/systemd.go

@@ -34,6 +34,21 @@ func stopWGQuick(iface string) error {
 	return nil
 }
 
+func enableWGQuick(iface string) error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "enable", "wg-quick@"+iface+".service")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("systemctl enable wg-quick@%s: %w: %s", iface, err, string(out))
+	}
+	return nil
+}
+
+func disableWGQuick(iface string) error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "disable", "wg-quick@"+iface+".service")
+	// Ignore failures — unit may already be disabled.
+	_ = cmd.Run()
+	return nil
+}
+
 // symlinkWGQuickConf creates (or atomically replaces) the symlink
 // /etc/wireguard/<iface>.conf → target via sudo. /etc/wireguard/ is
 // owned root:root 700 so the edgeguard user cannot write to it directly;