feat(waf): Phase 1 — Migration + Service + Handler — v1.2.66

- Migration 0037: waf_configs-Tabelle (domain_id FK, enabled=false default,
  mode/paranoia_level/rule_exclusions/trusted_proxies/custom_rules)
- models/waf.go: WafConfig-Model
- services/waf/waf.go: Repo (List, GetByDomain, Upsert, ListEnabled)
- handlers/waf.go: GET /waf/configs, GET /waf/configs/:id, PUT /waf/configs/:id
  — GET liefert Default-Config (disabled) wenn noch kein Row existiert
- main.go: WafHandler registriert

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/models/waf.go

@@ -0,0 +1,19 @@
+package models
+
+import "time"
+
+// WafConfig holds the per-domain WAF policy.
+// Default on creation: enabled=false, mode=detection, paranoia_level=1.
+type WafConfig struct {
+	ID             int64     `gorm:"primaryKey"                   json:"id"`
+	DomainID       int64     `gorm:"column:domain_id;uniqueIndex"  json:"domain_id"`
+	Enabled        bool      `gorm:"column:enabled"               json:"enabled"`
+	Mode           string    `gorm:"column:mode"                  json:"mode"`           // "detection" | "blocking"
+	ParanoiaLevel  int       `gorm:"column:paranoia_level"        json:"paranoia_level"` // 1–4
+	RuleExclusions []string  `gorm:"column:rule_exclusions;type:text[]" json:"rule_exclusions"`
+	TrustedProxies []string  `gorm:"column:trusted_proxies;type:text[]" json:"trusted_proxies"`
+	CustomRules    string    `gorm:"column:custom_rules"          json:"custom_rules"`
+	UpdatedAt      time.Time `gorm:"column:updated_at"            json:"updated_at"`
+}
+
+func (WafConfig) TableName() string { return "waf_configs" }