feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

Backend:
- Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date)
- NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle)
- System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler)
- Domain-Response-Headers + Rate-Limit (Migration 0024)
- Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out
- apt-Service für Update-Banner (apt-get update + Versionsprüfung)
- Backup-Retry mit exponential backoff (retry_apt 3×)
- publish.sh fail-fast + cleanup-old.sh (max 10 Versionen)

Frontend:
- Audit-Log-Page (/audit) mit Filter + Pagination
- ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+)
- Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix)
- EmptyState-Komponente überall ausgerollt
- SSL: Aggregate-Karte (total/expiring/expired/errors)
- Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now
- NTP: Sync-Status-Karte (chronyc tracking live)
- Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats
- Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN)
- Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler)
- Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention
- Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint
- System-Regeln im Firewall als eigener Tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/apt-repo/cleanup-old.sh

@@ -0,0 +1,95 @@
+#!/bin/bash
+# Cleanup-old: löscht alle EdgeGuard-Versionen im Gitea Package
+# Registry außer den letzten N (default 10).
+#
+# Wird vom Makefile direkt nach erfolgreichem Upload aufgerufen. Reihen-
+# folge ist wichtig: ERST der neue Build hochladen, DANN die ältesten
+# wegschmeißen — sonst riskieren wir bei Cleanup-vor-Upload eine Lücke.
+#
+# Voraussetzungen:
+#   - ~/.gitea-token mit write-Package-Scope
+#   - jq + curl
+#
+# Aufruf:
+#   ./cleanup-old.sh             # KEEP=10 (default)
+#   KEEP=20 ./cleanup-old.sh     # mehr behalten
+
+set -euo pipefail
+
+KEEP="${KEEP:-10}"
+OWNER="projekte"
+DIST="trixie"
+COMPONENT="main"
+BASE="https://git.netcell-it.de"
+
+if [ -z "${GITEA_TOKEN:-}" ]; then
+  if [ -r "$HOME/.gitea-token" ]; then
+    GITEA_TOKEN="$(tr -d '\n' < "$HOME/.gitea-token")"
+  else
+    echo "cleanup-old: missing ~/.gitea-token and GITEA_TOKEN env" >&2
+    exit 1
+  fi
+fi
+TOK="$GITEA_TOKEN"
+
+# Pkg-Spec: "name:arch". arch="all" für noarch-Pakete (meta + UI),
+# "amd64" für edgeguard-api. Mehrere arch je name = mehrere Zeilen.
+PKGS=(
+  "edgeguard:all"
+  "edgeguard-api:amd64"
+  "edgeguard-ui:all"
+)
+
+cleanup_pkg() {
+  local pkg="$1"
+  local arch="$2"
+
+  # Versionen sammeln. Gitea Package-API liefert flache Liste:
+  # /api/v1/packages/{owner}?type=debian&q={name}
+  # Wir filtern client-seitig auf name (exact-match — Gitea-Query ist
+  # leider substring-fuzzy) und sort -V (semver) absteigend.
+  local raw
+  raw="$(curl -fsS -H "Authorization: token $TOK" \
+    "$BASE/api/v1/packages/$OWNER?type=debian&q=$pkg&limit=1000")"
+
+  local versions
+  versions="$(printf '%s' "$raw" | jq -r --arg n "$pkg" \
+    '.[] | select(.name==$n) | .version' | sort -V -r | awk '!seen[$0]++')"
+
+  if [ -z "$versions" ]; then
+    echo "  $pkg ($arch): no versions found, skip"
+    return 0
+  fi
+
+  local count
+  count="$(printf '%s\n' "$versions" | wc -l)"
+  if [ "$count" -le "$KEEP" ]; then
+    echo "  $pkg ($arch): $count versions, ≤ keep=$KEEP, nothing to delete"
+    return 0
+  fi
+
+  local to_delete
+  to_delete="$(printf '%s\n' "$versions" | tail -n +$((KEEP+1)))"
+
+  local kept_count=$((count - $(printf '%s\n' "$to_delete" | wc -l)))
+  echo "  $pkg ($arch): $count versions total, keeping $kept_count newest, deleting $(printf '%s\n' "$to_delete" | wc -l)"
+
+  while IFS= read -r v; do
+    [ -z "$v" ] && continue
+    # DELETE-Endpoint für Debian-Pakete:
+    #   /api/packages/{owner}/debian/pool/{dist}/{comp}/{name}/{version}/{arch}
+    local url="$BASE/api/packages/$OWNER/debian/pool/$DIST/$COMPONENT/$pkg/$v/$arch"
+    local http
+    http="$(curl -sS -o /dev/null -w '%{http_code}' \
+      -X DELETE -H "Authorization: token $TOK" "$url")"
+    case "$http" in
+      204|404) echo "    delete $pkg $v $arch -> $http" ;;
+      *)       echo "    delete $pkg $v $arch -> $http (failed)" ;;
+    esac
+  done <<< "$to_delete"
+}
+
+for spec in "${PKGS[@]}"; do
+  IFS=':' read -r pkg arch <<< "$spec"
+  cleanup_pkg "$pkg" "$arch"
+done