feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

Backend:
- Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date)
- NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle)
- System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler)
- Domain-Response-Headers + Rate-Limit (Migration 0024)
- Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out
- apt-Service für Update-Banner (apt-get update + Versionsprüfung)
- Backup-Retry mit exponential backoff (retry_apt 3×)
- publish.sh fail-fast + cleanup-old.sh (max 10 Versionen)

Frontend:
- Audit-Log-Page (/audit) mit Filter + Pagination
- ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+)
- Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix)
- EmptyState-Komponente überall ausgerollt
- SSL: Aggregate-Karte (total/expiring/expired/errors)
- Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now
- NTP: Sync-Status-Karte (chronyc tracking live)
- Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats
- Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN)
- Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler)
- Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention
- Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint
- System-Regeln im Firewall als eigener Tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -85,21 +85,14 @@ deb: deb-amd64 deb-arm64
 GITEA_DEB_URL := https://git.netcell-it.de/api/packages/projekte/debian/pool/trixie/main/upload
 
 publish-amd64: deb-amd64
-	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \
-	if [ -z "$$TOK" ]; then echo "publish: ~/.gitea-token is empty"; exit 1; fi; \
-	for f in edgeguard-api_$(VERSION)_amd64.deb edgeguard-ui_$(VERSION)_all.deb edgeguard_$(VERSION)_all.deb; do \
-	  echo "  -> publish $$f"; \
-	  curl -sS -H "Authorization: token $$TOK" --upload-file build/deb/$$f $(GITEA_DEB_URL); \
-	  echo ""; \
-	done
+	@./scripts/apt-repo/publish.sh $(VERSION) amd64
+	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
+	@./scripts/apt-repo/cleanup-old.sh
 
 publish-arm64: deb-arm64
-	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \
-	if [ -z "$$TOK" ]; then echo "publish: ~/.gitea-token is empty"; exit 1; fi; \
-	echo "  -> publish edgeguard-api_$(VERSION)_arm64.deb"; \
-	curl -sS -H "Authorization: token $$TOK" \
-	    --upload-file build/deb/edgeguard-api_$(VERSION)_arm64.deb \
-	    $(GITEA_DEB_URL)
+	@./scripts/apt-repo/publish.sh $(VERSION) arm64
+	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
+	@./scripts/apt-repo/cleanup-old.sh
 
 publish: publish-amd64 publish-arm64