feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

Backend:
- Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date)
- NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle)
- System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler)
- Domain-Response-Headers + Rate-Limit (Migration 0024)
- Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out
- apt-Service für Update-Banner (apt-get update + Versionsprüfung)
- Backup-Retry mit exponential backoff (retry_apt 3×)
- publish.sh fail-fast + cleanup-old.sh (max 10 Versionen)

Frontend:
- Audit-Log-Page (/audit) mit Filter + Pagination
- ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+)
- Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix)
- EmptyState-Komponente überall ausgerollt
- SSL: Aggregate-Karte (total/expiring/expired/errors)
- Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now
- NTP: Sync-Status-Karte (chronyc tracking live)
- Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats
- Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN)
- Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler)
- Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention
- Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint
- System-Regeln im Firewall als eigener Tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/edgeguard-ctl/main.go

@@ -28,7 +28,16 @@ Commands:
   render-config                Regenerate haproxy / nftables configs from PG (--no-reload, --only=)
   wg-import [--path <dir>]     Import existing /etc/wireguard/*.conf files into the DB
   reset-password               Generate a one-time token for the /reset-password UI flow
-  cluster-join                 Join an existing cluster (Phase 3, not yet implemented)
+  cluster-join <primary> --token <…>
+                               Provision Cluster-TLS material on this node by
+                               exchanging the join-token at the primary's
+                               /api/v1/cluster/issue-cert endpoint. Writes
+                               ca.crt + peer.{crt,key} into /var/lib/edgeguard/
+                               cluster-tls/. PG-Basebackup + KeyDB replica
+                               setup remain manual until Phase 3.5.
+  cluster-renew-self           Re-issue this node's peer.{crt,key} using the
+                               local cluster CA (founder/single-node only).
+                               1-year validity. Restart edgeguard-api after.
   promote                      Promote this node's PG to primary (Phase 3, not yet implemented)
   dump-config                  Print effective config (Phase 3, not yet implemented)
 `
@@ -53,7 +62,11 @@ func main() {
 		os.Exit(cmdWGImport(os.Args[2:]))
 	case "reset-password":
 		os.Exit(cmdResetPassword())
-	case "cluster-join", "cluster-leave", "promote", "dump-config":
+	case "cluster-join":
+		os.Exit(cmdClusterJoin(os.Args[2:]))
+	case "cluster-renew-self":
+		os.Exit(cmdClusterRenewSelf(os.Args[2:]))
+	case "cluster-leave", "promote", "dump-config":
 		fmt.Fprintf(os.Stderr, "edgeguard-ctl: %q is a Phase-3 stub — not yet implemented\n", os.Args[1])
 		os.Exit(1)
 	default: