feat(cluster): PG Logical Replication + VIP/Keepalived + config_hash sync (v1.2.1–1.2.2)

- PG Logical Replication: edgeguard_shared PUBLICATION auf Primary,
  edgeguard_sub SUBSCRIPTION auf Secondary. Nur geteilte Config-Tabellen
  werden repliziert; node-eigene Daten (network_interfaces, ip_addresses,
  static_routes, cluster_settings, dns_settings, ntp_settings) bleiben
  lokal — OPNsense-Muster.
- cluster-init-replication: Erstellt PUBLICATION, Rolle + pg_hba-Einträge
  (logical + replication), WAL-Level auf logical.
- cluster-setup-standby: Erstellt SUBSCRIPTION (copy_data=true), pollt
  pg_subscription_rel bis alle Tabellen sync = 'r', rendert dann Configs.
- promote: manueller Failover via pg_promote() + touch recovery.signal.
- VIP/Keepalived: cluster_settings-Tabelle (vip_address, vip_interface,
  vrrp_router_id), /cluster/vip-settings API, Keepalived-Config-Generator
  mit VRRP + check_script + notify-Skripten in /usr/lib/edgeguard/scripts/.
- config_hash sync: Secondary pusht alle 5 Min seinen Hash via mTLS an
  Primary (PushSelfToPrimary). Heartbeat schreibt nur LOCAL, daher ohne
  aktiven Push wäre Primary-Sicht des Secondary-Hash stale gewesen.
- runSecondaryConfigRender: Goroutine auf Secondary rendert HAProxy+nftables
  neu wenn config_hash sich ändert (Logical-Replication-Nachzügler).
- confighash: node-spezifische Tabellen aus hashSpec entfernt.
- postinst: Keepalived-Skripte installieren, sudoers für keepalived.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packaging/debian/edgeguard-api/DEBIAN/postinst

@@ -130,6 +130,9 @@ edgeguard ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit=edgeguard-upgrade.ser
 # unter /var/lib/edgeguard/restore.sh, Unit-Form ist fix.
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl reset-failed edgeguard-restore.service
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit=edgeguard-restore.service --description=EdgeGuard self-restore --collect bash /var/lib/edgeguard/restore.sh
+# Keepalived reload: VIP-Settings-Änderung triggert keepalived-Reload.
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl reload-or-restart keepalived.service
+edgeguard ALL=(root) NOPASSWD: /bin/systemctl reload-or-restart keepalived.service
 SUDOERS
 
         # ── Distro-Conf-Includes für die per-Service Renderer ─────────
@@ -397,6 +400,17 @@ ROUTESUNIT
             chown "$EG_USER":"$EG_USER" /etc/edgeguard/routes.conf
         fi
 
+        # ── Keepalived notify-scripts installieren ───────────────────
+        # Die Skripte liegen im Package unter /usr/lib/edgeguard/ und
+        # werden von Keepalived als notify_master / notify_backup / check
+        # aufgerufen. Kein Auto-Promote — keepalived-master.sh loggt nur.
+        install -d -m 0755 /usr/lib/edgeguard
+        for script in keepalived-check.sh keepalived-master.sh keepalived-backup.sh; do
+            if [ -f "/usr/lib/edgeguard/${script}" ]; then
+                chmod 0755 "/usr/lib/edgeguard/${script}"
+            fi
+        done
+
         # ── Self-signed default cert so HAProxy starts cleanly ───────
         # HAProxy `bind :443 ssl crt /etc/edgeguard/tls/` needs at least
         # one PEM in the directory to come up. Operator runs certbot

packaging/scripts/keepalived-backup.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# Keepalived notify_backup / notify_fault: VIP abgegeben oder Fault.
+logger -t keepalived -p daemon.info \
+    "BACKUP/FAULT: VIP abgegeben an Primary-Node."
+
+curl -sf --max-time 3 -X POST \
+    -H "Content-Type: application/json" \
+    -d '{"level":"info","message":"Keepalived BACKUP: VIP abgegeben — Primary ist wieder aktiv.","source":"keepalived"}' \
+    http://127.0.0.1:9443/api/v1/internal/alert > /dev/null 2>&1 || true

packaging/scripts/keepalived-check.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# Keepalived health check: edgeguard-api erreichbar?
+# Weight -50 → BACKUP gewinnt wenn Primary-API nicht antwortet.
+curl -sf --max-time 2 --unix-socket /run/edgeguard/api.sock \
+    http://localhost/api/v1/system/health > /dev/null 2>&1 \
+    || curl -sf --max-time 2 http://127.0.0.1:9443/api/v1/system/health > /dev/null 2>&1

packaging/scripts/keepalived-master.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# Keepalived notify_master: dieser Node hat die VIP übernommen.
+#
+# KEIN Auto-Promote — Split-Brain-Schutz durch manuelle Promotion.
+# Admin muss "edgeguard-ctl promote" ausführen wenn PG-Failover gewünscht.
+#
+# Was wir tun: Alert loggen + edgeguard-api benachrichtigen.
+logger -t keepalived -p daemon.warning \
+    "MASTER: VIP übernommen — PG-Rolle ist noch '$(cat /var/lib/edgeguard/pg_role 2>/dev/null || echo standby)'. Für PG-Failover: edgeguard-ctl promote"
+
+# Alert an die API schicken (best-effort, ignoriert Fehler)
+curl -sf --max-time 3 -X POST \
+    -H "Content-Type: application/json" \
+    -d '{"level":"warning","message":"Keepalived MASTER: VIP übernommen. Wenn PG-Failover gewünscht: edgeguard-ctl promote ausführen.","source":"keepalived"}' \
+    http://127.0.0.1:9443/api/v1/internal/alert > /dev/null 2>&1 || true