feat(waf): Phase 1 — Migration + Service + Handler — v1.2.66

- Migration 0037: waf_configs-Tabelle (domain_id FK, enabled=false default,
  mode/paranoia_level/rule_exclusions/trusted_proxies/custom_rules)
- models/waf.go: WafConfig-Model
- services/waf/waf.go: Repo (List, GetByDomain, Upsert, ListEnabled)
- handlers/waf.go: GET /waf/configs, GET /waf/configs/:id, PUT /waf/configs/:id
  — GET liefert Default-Config (disabled) wenn noch kein Row existiert
- main.go: WafHandler registriert

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/edgeguard-api/main.go

@@ -59,6 +59,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 	wgsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/wireguard"
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+	wafsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
 )
 
 var version = "1.2.35"
@@ -383,6 +384,7 @@ func main() {
 		}
 		handlers.NewFirewallHandler(fwZones, fwAddrObj, fwAddrGrp, fwSvc, fwSvcGrp, fwRules, fwNAT, auditRepo, nodeID, fwReloader, pool).Register(authed)
 		handlers.NewCrowdSecHandler(auditRepo, nodeID).Register(authed)
+		handlers.NewWafHandler(wafsvc.New(pool), auditRepo, nodeID).Register(authed)
 
 		// withFW wraps a service-reloader so that AFTER the service is
 		// reloaded, the firewall is also re-rendered. Necessary for