feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

Backend:
- Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date)
- NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle)
- System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler)
- Domain-Response-Headers + Rate-Limit (Migration 0024)
- Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out
- apt-Service für Update-Banner (apt-get update + Versionsprüfung)
- Backup-Retry mit exponential backoff (retry_apt 3×)
- publish.sh fail-fast + cleanup-old.sh (max 10 Versionen)

Frontend:
- Audit-Log-Page (/audit) mit Filter + Pagination
- ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+)
- Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix)
- EmptyState-Komponente überall ausgerollt
- SSL: Aggregate-Karte (total/expiring/expired/errors)
- Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now
- NTP: Sync-Status-Karte (chronyc tracking live)
- Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats
- Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN)
- Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler)
- Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention
- Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint
- System-Regeln im Firewall als eigener Tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/services/domainheaders/domainheaders.go

@@ -0,0 +1,125 @@
+// Package domainheaders implements CRUD against the
+// `domain_response_headers` table. Pro-Domain Response-Header die
+// HAProxy via `http-response set-header` setzt.
+package domainheaders
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+var ErrNotFound = errors.New("domain response header not found")
+
+type Repo struct {
+	Pool *pgxpool.Pool
+}
+
+func New(pool *pgxpool.Pool) *Repo { return &Repo{Pool: pool} }
+
+const baseSelect = `
+SELECT id, domain_id, name, value, position, created_at, updated_at
+FROM domain_response_headers
+`
+
+// ListForDomain liefert alle Header einer Domain in stabiler Position-Sortierung.
+func (r *Repo) ListForDomain(ctx context.Context, domainID int64) ([]models.DomainResponseHeader, error) {
+	rows, err := r.Pool.Query(ctx,
+		baseSelect+` WHERE domain_id = $1 ORDER BY position ASC, id ASC`, domainID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]models.DomainResponseHeader, 0, 4)
+	for rows.Next() {
+		h, err := scan(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *h)
+	}
+	return out, rows.Err()
+}
+
+// ListAll holt alle Header (über alle Domains) — der HAProxy-Renderer
+// braucht das, um pro Domain die Einträge zu gruppieren.
+func (r *Repo) ListAll(ctx context.Context) ([]models.DomainResponseHeader, error) {
+	rows, err := r.Pool.Query(ctx, baseSelect+` ORDER BY domain_id, position, id`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]models.DomainResponseHeader, 0, 16)
+	for rows.Next() {
+		h, err := scan(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *h)
+	}
+	return out, rows.Err()
+}
+
+func (r *Repo) Get(ctx context.Context, id int64) (*models.DomainResponseHeader, error) {
+	row := r.Pool.QueryRow(ctx, baseSelect+` WHERE id = $1`, id)
+	h, err := scan(row)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, err
+	}
+	return h, nil
+}
+
+func (r *Repo) Create(ctx context.Context, h models.DomainResponseHeader) (*models.DomainResponseHeader, error) {
+	row := r.Pool.QueryRow(ctx, `
+INSERT INTO domain_response_headers (domain_id, name, value, position)
+VALUES ($1, $2, $3, $4)
+RETURNING id, domain_id, name, value, position, created_at, updated_at`,
+		h.DomainID, h.Name, h.Value, h.Position)
+	return scan(row)
+}
+
+func (r *Repo) Update(ctx context.Context, id int64, h models.DomainResponseHeader) (*models.DomainResponseHeader, error) {
+	row := r.Pool.QueryRow(ctx, `
+UPDATE domain_response_headers SET
+   name = $1, value = $2, position = $3, updated_at = NOW()
+WHERE id = $4
+RETURNING id, domain_id, name, value, position, created_at, updated_at`,
+		h.Name, h.Value, h.Position, id)
+	out, err := scan(row)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, err
+	}
+	return out, nil
+}
+
+func (r *Repo) Delete(ctx context.Context, id int64) error {
+	tag, err := r.Pool.Exec(ctx, `DELETE FROM domain_response_headers WHERE id = $1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func scan(row interface{ Scan(...any) error }) (*models.DomainResponseHeader, error) {
+	var h models.DomainResponseHeader
+	if err := row.Scan(
+		&h.ID, &h.DomainID, &h.Name, &h.Value, &h.Position,
+		&h.CreatedAt, &h.UpdatedAt,
+	); err != nil {
+		return nil, err
+	}
+	return &h, nil
+}