feat(waf): Phase 5 — WAF-UI (per-Domain Konfiguration) — v1.2.71

- pages/WAF/index.tsx: neue WAF-Seite mit Status-Strip,
  Domänen-Tabelle (Toggle/Mode/PL) + Konfigurations-Drawer pro Domain
  (enabled, mode, paranoia_level 1-4, rule_exclusions, trusted_proxies,
  custom_rules). Quick-Toggle ohne Drawer; Hinweis: erst Detection, dann Blocking.
- App.tsx: /waf Route + lazy import
- Sidebar.tsx: WAF im Security-Bereich
- i18n EN + DE

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/en/common.json

@@ -34,7 +34,8 @@
       "network": "Network",
       "security": "Security",
       "system": "System"
-    }
+    },
+    "waf": "WAF"
   },
   "fw": {
     "title": "Firewall",
@@ -1759,5 +1760,46 @@
       "disabled": "Not installed",
       "confirmRemove": "Really remove collection {{name}}?"
     }
+  },
+  "waf": {
+    "title": "Web Application Firewall",
+    "intro": "Per-domain HTTP request inspection via Coraza/OWASP CRS. Default: off for all domains.",
+    "configure": "Configure",
+    "toggleFailed": "Could not change WAF state.",
+    "defaultOffHint": "WAF is disabled by default for all domains. Enable and configure per domain below.",
+    "col": {
+      "domain": "Domain",
+      "status": "WAF",
+      "mode": "Mode",
+      "paranoia": "Paranoia"
+    },
+    "stat": {
+      "protected": "Protected",
+      "blocking": "Blocking",
+      "detection": "Detection only"
+    },
+    "mode": {
+      "detection": "Detection",
+      "blocking": "Blocking"
+    },
+    "pl": {
+      "1": "Basic (recommended)",
+      "2": "Standard",
+      "3": "Advanced",
+      "4": "Maximum (may break traffic)"
+    },
+    "config": {
+      "enabled": "Enabled",
+      "mode": "Mode",
+      "paranoia": "Paranoia Level",
+      "exclusions": "Rule Exclusions",
+      "exclusionsHint": "Comma-separated rule IDs to disable (e.g. 920350, 941130).",
+      "trustedProxies": "Trusted Proxies",
+      "trustedProxiesHint": "IPs/CIDRs that bypass WAF inspection (e.g. internal load balancers).",
+      "customRules": "Custom SecRules",
+      "customRulesHint": "Raw SecRule directives appended after the CRS. Applied last, can override CRS rules.",
+      "defaultHint": "Default: Detection-Only, Paranoia Level 1. Switch to Blocking only after reviewing alerts.",
+      "saveFailed": "Failed to save WAF configuration."
+    }
   }
 }