feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

Backend:
- Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date)
- NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle)
- System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler)
- Domain-Response-Headers + Rate-Limit (Migration 0024)
- Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out
- apt-Service für Update-Banner (apt-get update + Versionsprüfung)
- Backup-Retry mit exponential backoff (retry_apt 3×)
- publish.sh fail-fast + cleanup-old.sh (max 10 Versionen)

Frontend:
- Audit-Log-Page (/audit) mit Filter + Pagination
- ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+)
- Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix)
- EmptyState-Komponente überall ausgerollt
- SSL: Aggregate-Karte (total/expiring/expired/errors)
- Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now
- NTP: Sync-Status-Karte (chronyc tracking live)
- Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats
- Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN)
- Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler)
- Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention
- Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint
- System-Regeln im Firewall als eigener Tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/database/migrations/0023_domains_settings.sql

@@ -0,0 +1,39 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Domain-Settings die HAProxy pro Domain rendern kann. Bisher
+-- hatten Domains nur ein binäres hsts_enabled — jetzt ist HSTS
+-- granular (max-age, subdomains, preload) plus Maintenance-Mode
+-- und Canonical-www-Redirect.
+
+ALTER TABLE domains
+    ADD COLUMN IF NOT EXISTS hsts_max_age        INTEGER NOT NULL DEFAULT 31536000,
+    ADD COLUMN IF NOT EXISTS hsts_subdomains     BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS hsts_preload        BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS maintenance_mode    BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS maintenance_message TEXT,
+    ADD COLUMN IF NOT EXISTS www_redirect        TEXT NOT NULL DEFAULT '';
+
+-- www_redirect-Werte:
+--   ''        — kein Redirect (Default; Domain wird direkt geserved)
+--   'to-naked'— www.foo.com → foo.com (canonical naked-domain)
+--   'to-www'  — foo.com → www.foo.com (canonical www)
+ALTER TABLE domains
+    DROP CONSTRAINT IF EXISTS domains_www_redirect_check;
+ALTER TABLE domains
+    ADD CONSTRAINT domains_www_redirect_check
+        CHECK (www_redirect IN ('', 'to-naked', 'to-www'));
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE domains DROP CONSTRAINT IF EXISTS domains_www_redirect_check;
+ALTER TABLE domains
+    DROP COLUMN IF EXISTS www_redirect,
+    DROP COLUMN IF EXISTS maintenance_message,
+    DROP COLUMN IF EXISTS maintenance_mode,
+    DROP COLUMN IF EXISTS hsts_preload,
+    DROP COLUMN IF EXISTS hsts_subdomains,
+    DROP COLUMN IF EXISTS hsts_max_age;
+-- +goose StatementEnd

internal/database/migrations/0024_domain_headers_ratelimit.sql

@@ -0,0 +1,58 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Phase 2 Domain-Settings:
+--   * rate_limit_rps  — Requests pro Sekunde Cap je Client-IP (0 = aus).
+--     HAProxy implementiert das via per-Domain Stick-Table (siehe
+--     internal/haproxy/haproxy.cfg.tpl).
+--   * max_body_kb     — max. Request-Body-Größe in KiB (0 = aus).
+--     HAProxy verweigert größere Requests mit 413.
+--   * domain_response_headers — beliebige Set-Header Pairs die je
+--     Domain auf jede Response gesetzt werden (CORS, CSP, X-Frame-
+--     Options, …). HAProxy rendert pro Eintrag einen `http-response
+--     set-header` mit Host-ACL.
+
+ALTER TABLE domains
+    ADD COLUMN IF NOT EXISTS rate_limit_rps INTEGER NOT NULL DEFAULT 0,
+    ADD COLUMN IF NOT EXISTS max_body_kb    INTEGER NOT NULL DEFAULT 0;
+
+ALTER TABLE domains
+    DROP CONSTRAINT IF EXISTS domains_rate_limit_rps_check;
+ALTER TABLE domains
+    ADD CONSTRAINT domains_rate_limit_rps_check CHECK (rate_limit_rps >= 0);
+
+ALTER TABLE domains
+    DROP CONSTRAINT IF EXISTS domains_max_body_kb_check;
+ALTER TABLE domains
+    ADD CONSTRAINT domains_max_body_kb_check CHECK (max_body_kb >= 0);
+
+CREATE TABLE IF NOT EXISTS domain_response_headers (
+    id          BIGSERIAL PRIMARY KEY,
+    domain_id   BIGINT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    name        TEXT   NOT NULL,
+    value       TEXT   NOT NULL,
+    position    INTEGER NOT NULL DEFAULT 0,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ein Header-Name darf pro Domain nur einmal auftauchen (case-insensitive,
+-- HTTP-Header sind per RFC nicht case-sensitive). Verhindert dass zwei
+-- konkurrierende Werte für "X-Frame-Options" gesetzt werden.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_drh_domain_name_ci
+    ON domain_response_headers (domain_id, lower(name));
+
+CREATE INDEX IF NOT EXISTS idx_drh_domain
+    ON domain_response_headers (domain_id, position);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP TABLE IF EXISTS domain_response_headers;
+ALTER TABLE domains DROP CONSTRAINT IF EXISTS domains_max_body_kb_check;
+ALTER TABLE domains DROP CONSTRAINT IF EXISTS domains_rate_limit_rps_check;
+ALTER TABLE domains
+    DROP COLUMN IF EXISTS max_body_kb,
+    DROP COLUMN IF EXISTS rate_limit_rps;
+-- +goose StatementEnd

internal/database/migrations/0025_join_tokens_used.sql

@@ -0,0 +1,28 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Phase 3.4: Cluster-Join-Token One-Shot-Consume-Tracking.
+--
+-- Token-Format ist HMAC-self-contained (siehe internal/cluster/jointoken):
+-- nonce + expires_at + ca-fingerprint, signiert mit dem Cluster-Join-
+-- Secret. Damit der Token wirklich nur EINMAL benutzbar ist, speichern
+-- wir die nonce beim Consume — Re-Use → 409. expires_at hilft beim
+-- Cleanup (Tokens älter als ihre eigene Expiry können gelöscht werden,
+-- auch ungebraucht).
+
+CREATE TABLE IF NOT EXISTS join_tokens_used (
+    nonce       TEXT PRIMARY KEY,
+    used_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at  TIMESTAMPTZ NOT NULL,
+    consumed_by TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_join_tokens_used_expires
+    ON join_tokens_used (expires_at);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP TABLE IF EXISTS join_tokens_used;
+-- +goose StatementEnd