feat(radius): RADIUS-Server via FreeRADIUS (PAP/CHAP) — v1.2.93

Files-basierter RADIUS-Server (Clients + Users), managed analog DHCP/WireGuard.
- Migration 0042: radius_settings (singleton, node-lokal), radius_clients (secret_enc), radius_users (password_enc) — Secrets via secrets.Box verschlüsselt.
- internal/freeradius: Multi-File-Renderer (clients.conf + authorize) via Box.Open, Secret-Escaping (" \), Service default-off/an enabled gekoppelt. internal/services/radius + internal/handlers/radius.go: Settings + Client/User-CRUD, write-only Secret-Semantik, Validierung (IP/CIDR, name-charset), GET liefert secret_configured statt Secret.
- Firewall: udp 1812/1813 Auto-Rule bei enabled. Cluster: clients/users repliziert (hashSpec), radius_settings node-lokal.
- main.go + render.go + WithAllReloaders. Packaging: freeradius Dependency, setgid-Dir /etc/edgeguard/freeradius (Gruppe freeradius), Symlinks clients.conf+authorize, disable-on-install, sudoers.
- UI: RADIUS-Seite (Einstellungen + Clients + Benutzer) unter Sicherheit, Route/Nav/i18n de/en.
- Tests (guarded): Renderer-Inhalt + Secret-Escaping/Roundtrip + Masking. Scope v1: PAP/CHAP files-based (kein EAP/802.1X).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

management-ui/src/components/Layout/AppLayout.tsx

@@ -23,6 +23,7 @@ const PAGE_TITLES: Record<string, string> = {
   '/ntp':            'nav.ntp',
   '/vpn/wireguard':  'nav.wireguard',
   '/forward-proxy':  'nav.forwardProxy',
+  '/radius':         'nav.radius',
   '/firewall/live':  'nav.firewallLive',
   '/firewall':       'nav.firewall',
   '/cluster':        'nav.cluster',

management-ui/src/components/Layout/Sidebar.tsx

@@ -18,6 +18,7 @@ import {
   DatabaseOutlined,
   FireOutlined,
   GlobalOutlined,
+  IdcardOutlined,
   NodeIndexOutlined,
   RadarChartOutlined,
   SafetyCertificateOutlined,
@@ -80,6 +81,7 @@ const NAV: NavSection[] = [
       { path: '/forward-proxy',  labelKey: 'nav.forwardProxy', icon: <CloudServerOutlined /> },
       { path: '/crowdsec',       labelKey: 'nav.crowdsec',     icon: <RadarChartOutlined /> },
       { path: '/waf',            labelKey: 'nav.waf',          icon: <SafetyCertificateOutlined /> },
+      { path: '/radius',         labelKey: 'nav.radius',       icon: <IdcardOutlined /> },
     ],
   },
   {