feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung
- keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload)
- confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix)
- TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login
- Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator
- fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen
- VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034)
- Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032)
- unbound-control: edgeguard in unbound-Gruppe via postinst

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/styles/enterprise.css

@@ -2850,6 +2850,17 @@ h1, h2, h3, h4, h5, h6 {
 .fw-rule-row--disabled td:first-child {
   opacity: 1 !important;
 }
+/* Strikethrough on disabled rule name */
+.fw-rule-row--disabled .fw-rule-name {
+  text-decoration: line-through;
+  text-decoration-color: #94A3B8;
+}
+
+/* Zero-hit rule: amber left border (potentially unused/shadowed policy) */
+.fw-rule-row--zero-hit td:first-child {
+  border-left: 3px solid #FAAD14 !important;
+  padding-left: 5px;
+}
 
 /* Enabled status dot */
 .fw-rule-dot {
@@ -2869,6 +2880,31 @@ h1, h2, h3, h4, h5, h6 {
   line-height: 1;
 }
 
+/* Action buttons: hidden by default, reveal on row hover */
+.fw-row-actions {
+  opacity: 0;
+  transition: opacity 0.12s ease;
+}
+.ant-table-row:hover .fw-row-actions {
+  opacity: 1;
+}
+
+/* Natural-language rule description */
+.fw-rule-desc {
+  font-size: 11px;
+  color: #94A3B8;
+  margin-top: 2px;
+  font-family: ui-monospace, 'Cascadia Code', monospace;
+  letter-spacing: 0.01em;
+}
+
+/* "any" address label */
+.fw-addr-any {
+  font-size: 11px;
+  color: #94A3B8;
+  font-style: italic;
+}
+
 /* Filter bar */
 .fw-filter-bar {
   display: flex;