feat(diagnostics): UI-Tools — ping/traceroute/dig/curl/tcp

Operator-Diagnose ohne SSH. Sidebar → System → Diagnose.

internal/services/diagnostics/:
  - Ping        — ping -c4 -W2 (12s timeout)
  - Traceroute  — traceroute -n -w2 -q1 -m20 (60s timeout)
  - Dig         — dig +timeout=3 +tries=2 <TYPE> <NAME> (Types A/AAAA/
                  CNAME/MX/TXT/NS/SOA/PTR/SRV/CAA whitelisted)
  - Curl        — curl -IsSv --max-time 10 (nur http(s)://, kein
                  file:// / smb:// / data://)
  - TCPProbe    — nc -zv -w5 (8s timeout)

Sicherheit: validTarget() prüft jeden Input gegen Allow-List
[a-zA-Z0-9.:/_-]; verhindert Shell-Metachar-Injection. exec.Command
mit nackten Argument-Slices (kein /bin/sh, kein Glob-Expansion).

internal/handlers/diagnostics.go: POST /api/v1/diagnostics/<tool>
hinter requireAuth.

UI (pages/Diagnostics): 5 Tool-Cards, jede mit eigenem Input + Run-
Button + monospace-Output-Pane (dunkel, scrollbar, max-height 320px).
Pro Tool ein Status-Tag (OK / exit N) + Dauer-ms. info-Alert oben
erklärt dass Tools auf der Box laufen, nicht im Browser; security-
Alert unten erklärt die Restrictions.

control: iputils-ping, traceroute, dnsutils, curl, netcat-openbsd
als Depends. Auf Test-Box bereits da (waren Distro-defaults).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

management-ui/src/components/Layout/AppLayout.tsx

@@ -21,6 +21,7 @@ const PAGE_TITLES: Record<string, string> = {
   '/cluster':       'nav.cluster',
   '/logs':          'nav.logs',
   '/backups':       'nav.backups',
+  '/diagnostics':   'nav.diagnostics',
   '/license':       'nav.license',
   '/settings':      'nav.settings',
 }

management-ui/src/components/Layout/Sidebar.tsx

@@ -16,6 +16,7 @@ import {
   SafetyCertificateOutlined,
   SettingOutlined,
   ThunderboltOutlined,
+  ToolOutlined,
 } from '@ant-design/icons'
 import { useTranslation } from 'react-i18next'
 
@@ -72,8 +73,9 @@ const NAV: NavSection[] = [
   {
     labelKey: 'nav.section.system',
     items: [
-      { path: '/cluster',  labelKey: 'nav.cluster',  icon: <ApartmentOutlined /> },
-      { path: '/logs',     labelKey: 'nav.logs',     icon: <FileSearchOutlined /> },
+      { path: '/cluster',     labelKey: 'nav.cluster',     icon: <ApartmentOutlined /> },
+      { path: '/logs',        labelKey: 'nav.logs',        icon: <FileSearchOutlined /> },
+      { path: '/diagnostics', labelKey: 'nav.diagnostics', icon: <ToolOutlined /> },
       { path: '/backups',  labelKey: 'nav.backups',  icon: <DatabaseOutlined /> },
       { path: '/license',  labelKey: 'nav.license',  icon: <CrownOutlined /> },
       { path: '/settings', labelKey: 'nav.settings', icon: <SettingOutlined /> },
@@ -81,7 +83,7 @@ const NAV: NavSection[] = [
   },
 ]
 
-const VERSION = '1.0.71'
+const VERSION = '1.0.72'
 
 // Sidebar-Pattern 1:1 aus netcell-webpanel (enconf) übernommen:
 // - <nav> als root, dunkler Gradient + Teal/Blue-Accent