feat(waf): Phase 4 — Packaging, CRS, systemd, sudoers — v1.2.69

- Makefile: edgeguard-waf zu BINARIES hinzugefügt
- deploy/systemd/edgeguard-waf.service: systemd-Unit (User=edgeguard,
  After=postgresql + edgeguard-api, Hardening, ReadWritePaths=/var/log/edgeguard)
- build-package.sh: edgeguard-waf Binary + Service ins .deb
- postinst: OWASP CRS v4.7.0 Download bei Erstinstall nach
  /usr/share/edgeguard/waf/crs/; graceful wenn kein Internet vorhanden
- postinst: edgeguard-waf.service enable + start bei install/upgrade
- postinst: sudoers für start/stop/enable/disable/restart edgeguard-waf.service
- system.go: edgeguard-waf in servicesToCheck + toggleAllowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/system.go

@@ -197,6 +197,7 @@ var servicesToCheck = []struct{ Label, Unit string }{
 	{"postgresql", "postgresql"},
 	{"crowdsec", "crowdsec"},
 	{"crowdsec-firewall-bouncer", "crowdsec-firewall-bouncer"},
+	{"edgeguard-waf", "edgeguard-waf"},
 }
 
 type serviceStatus struct {
@@ -639,6 +640,7 @@ func (h *SystemHandler) ServiceRestart(c *gin.Context) {
 var toggleAllowlist = map[string]bool{
 	"crowdsec":                  true,
 	"crowdsec-firewall-bouncer": true,
+	"edgeguard-waf":             true,
 	"squid":                     true,
 	"unbound":                   true,
 }