feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

Backend:
- Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date)
- NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle)
- System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler)
- Domain-Response-Headers + Rate-Limit (Migration 0024)
- Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out
- apt-Service für Update-Banner (apt-get update + Versionsprüfung)
- Backup-Retry mit exponential backoff (retry_apt 3×)
- publish.sh fail-fast + cleanup-old.sh (max 10 Versionen)

Frontend:
- Audit-Log-Page (/audit) mit Filter + Pagination
- ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+)
- Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix)
- EmptyState-Komponente überall ausgerollt
- SSL: Aggregate-Karte (total/expiring/expired/errors)
- Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now
- NTP: Sync-Status-Karte (chronyc tracking live)
- Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats
- Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN)
- Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler)
- Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention
- Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint
- System-Regeln im Firewall als eigener Tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/components/Layout/Sidebar.tsx

@@ -1,5 +1,8 @@
 import { Link, useLocation } from 'react-router-dom'
 import type { ReactNode } from 'react'
+import { useQuery } from '@tanstack/react-query'
+
+import apiClient, { isEnvelope } from '../../api/client'
 import {
   ApartmentOutlined,
   BellOutlined,
@@ -10,6 +13,7 @@ import {
   DashboardOutlined,
   EyeOutlined,
   FileSearchOutlined,
+  AuditOutlined,
   DatabaseOutlined,
   FireOutlined,
   GlobalOutlined,
@@ -76,6 +80,7 @@ const NAV: NavSection[] = [
     items: [
       { path: '/cluster',     labelKey: 'nav.cluster',     icon: <ApartmentOutlined /> },
       { path: '/logs',        labelKey: 'nav.logs',        icon: <FileSearchOutlined /> },
+      { path: '/audit',       labelKey: 'nav.audit',       icon: <AuditOutlined /> },
       { path: '/diagnostics', labelKey: 'nav.diagnostics', icon: <ToolOutlined /> },
       { path: '/alerts',   labelKey: 'nav.alerts',   icon: <BellOutlined /> },
       { path: '/backups',  labelKey: 'nav.backups',  icon: <DatabaseOutlined /> },
@@ -85,8 +90,6 @@ const NAV: NavSection[] = [
   },
 ]
 
-const VERSION = '1.0.78'
-
 // Sidebar-Pattern 1:1 aus netcell-webpanel (enconf) übernommen:
 // - <nav> als root, dunkler Gradient + Teal/Blue-Accent
 // - Section-Label-Div NEBEN dem <ul>, nicht verschachtelt
@@ -97,6 +100,22 @@ export default function Sidebar({ isOpen, onClose }: SidebarProps) {
   const { t } = useTranslation()
   const location = useLocation()
 
+  // Version aus /system/health ziehen damit nach jedem Self-Upgrade
+  // automatisch die neue Versionsnummer in der Sidebar erscheint —
+  // ohne Hardcode, der beim Vergessen den Eindruck erweckt das Update
+  // sei nicht durchgelaufen.
+  const { data: health } = useQuery({
+    queryKey: ['system', 'health'],
+    queryFn: async () => {
+      const r = await apiClient.get('/system/health')
+      return isEnvelope(r.data) ? (r.data.data as { version?: string }) : { version: '' }
+    },
+    refetchInterval: 60_000,
+    refetchOnWindowFocus: true,
+    staleTime: 30_000,
+  })
+  const version = health?.version || '…'
+
   return (
     <nav className={`sidebar${isOpen ? ' open' : ''}`}>
       <div className="sidebar-logo">
@@ -139,7 +158,7 @@ export default function Sidebar({ isOpen, onClose }: SidebarProps) {
         </div>
       ))}
 
-      <div className="sidebar-version">v{VERSION}</div>
+      <div className="sidebar-version">v{version}</div>
     </nav>
   )
 }