feat(cluster): PG Logical Replication + VIP/Keepalived + config_hash sync (v1.2.1–1.2.2)

- PG Logical Replication: edgeguard_shared PUBLICATION auf Primary,
  edgeguard_sub SUBSCRIPTION auf Secondary. Nur geteilte Config-Tabellen
  werden repliziert; node-eigene Daten (network_interfaces, ip_addresses,
  static_routes, cluster_settings, dns_settings, ntp_settings) bleiben
  lokal — OPNsense-Muster.
- cluster-init-replication: Erstellt PUBLICATION, Rolle + pg_hba-Einträge
  (logical + replication), WAL-Level auf logical.
- cluster-setup-standby: Erstellt SUBSCRIPTION (copy_data=true), pollt
  pg_subscription_rel bis alle Tabellen sync = 'r', rendert dann Configs.
- promote: manueller Failover via pg_promote() + touch recovery.signal.
- VIP/Keepalived: cluster_settings-Tabelle (vip_address, vip_interface,
  vrrp_router_id), /cluster/vip-settings API, Keepalived-Config-Generator
  mit VRRP + check_script + notify-Skripten in /usr/lib/edgeguard/scripts/.
- config_hash sync: Secondary pusht alle 5 Min seinen Hash via mTLS an
  Primary (PushSelfToPrimary). Heartbeat schreibt nur LOCAL, daher ohne
  aktiven Push wäre Primary-Sicht des Secondary-Hash stale gewesen.
- runSecondaryConfigRender: Goroutine auf Secondary rendert HAProxy+nftables
  neu wenn config_hash sich ändert (Logical-Replication-Nachzügler).
- confighash: node-spezifische Tabellen aus hashSpec entfernt.
- postinst: Keepalived-Skripte installieren, sudoers für keepalived.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packaging/debian/edgeguard-api/DEBIAN/postinst

@@ -130,6 +130,9 @@ edgeguard ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit=edgeguard-upgrade.ser
 # unter /var/lib/edgeguard/restore.sh, Unit-Form ist fix.
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl reset-failed edgeguard-restore.service
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemd-run --unit=edgeguard-restore.service --description=EdgeGuard self-restore --collect bash /var/lib/edgeguard/restore.sh
+# Keepalived reload: VIP-Settings-Änderung triggert keepalived-Reload.
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl reload-or-restart keepalived.service
+edgeguard ALL=(root) NOPASSWD: /bin/systemctl reload-or-restart keepalived.service
 SUDOERS
 
         # ── Distro-Conf-Includes für die per-Service Renderer ─────────
@@ -397,6 +400,17 @@ ROUTESUNIT
             chown "$EG_USER":"$EG_USER" /etc/edgeguard/routes.conf
         fi
 
+        # ── Keepalived notify-scripts installieren ───────────────────
+        # Die Skripte liegen im Package unter /usr/lib/edgeguard/ und
+        # werden von Keepalived als notify_master / notify_backup / check
+        # aufgerufen. Kein Auto-Promote — keepalived-master.sh loggt nur.
+        install -d -m 0755 /usr/lib/edgeguard
+        for script in keepalived-check.sh keepalived-master.sh keepalived-backup.sh; do
+            if [ -f "/usr/lib/edgeguard/${script}" ]; then
+                chmod 0755 "/usr/lib/edgeguard/${script}"
+            fi
+        done
+
         # ── Self-signed default cert so HAProxy starts cleanly ───────
         # HAProxy `bind :443 ssl crt /etc/edgeguard/tls/` needs at least
         # one PEM in the directory to come up. Operator runs certbot