feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung
- keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload)
- confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix)
- TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login
- Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator
- fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen
- VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034)
- Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032)
- unbound-control: edgeguard in unbound-Gruppe via postinst

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/wireguard/wireguard.go

@@ -152,6 +152,7 @@ func (g *Generator) Render(ctx context.Context) error {
 			}
 			_ = os.Remove(filepath.Join(ConfDir, e.Name()))
 			_ = stopWGQuick(ifaceName)
+			_ = disableWGQuick(ifaceName)
 		}
 	}
 	return nil
@@ -235,6 +236,7 @@ func (g *Generator) renderIface(ctx context.Context, ifc models.WireguardInterfa
 	if err := symlinkWGQuickConf(ifc.Name, path); err != nil {
 		return fmt.Errorf("symlink: %w", err)
 	}
+	_ = enableWGQuick(ifc.Name)
 	if existing, err := os.ReadFile(path); err == nil && bytes.Equal(existing, body.Bytes()) {
 		return startWGQuick(ifc.Name)
 	}