fix(haproxy+unbound): http_to_https per Domain + leere Forward-Zones überspringen

haproxy: http_to_https=false Domains bekommen jetzt eigene use_backend-Regeln
im public_http-Frontend statt dem globalen HTTPS-Redirect. Das Feld war bisher
in DB + UI vorhanden aber vom Config-Generator komplett ignoriert.

unbound: Forward-Zones ohne forward-addr (ForwardTo=nil oder leer) werden jetzt
übersprungen. Unbound lehnt solche Blöcke beim Start ab.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/haproxy/haproxy.cfg.tpl

@@ -32,7 +32,8 @@ defaults
 
 # ── Public :80 ─────────────────────────────────────────────────────────
 # ACME-01 challenges proxy to edgeguard-api which serves the webroot.
-# Everything else redirects to HTTPS.
+# Domains with http_to_https=false bypass the redirect and are proxied
+# directly. Everything else redirects to HTTPS.
 frontend public_http
     bind :80
     {{- if .IPv6Enabled}}
@@ -40,11 +41,21 @@ frontend public_http
     {{- end}}
 
     acl is_acme path_beg /.well-known/acme-challenge/
+    {{- range $d := .HTTPDomains}}
+    acl is_http_only hdr(host) -i {{$d.Name}}
+    {{- end}}
 
-    # Redirect to HTTPS first (skipped for ACME paths) — must come
-    # before use_backend so HAProxy doesn't warn about ordering.
-    http-request redirect scheme https code 301 unless is_acme
+    # Redirect to HTTPS (skipped for ACME and http-only domains).
+    http-request redirect scheme https code 301 unless is_acme{{if .HTTPDomains}} or is_http_only{{end}}
 
+    {{- range $d := .HTTPDomains}}
+    {{- range $r := $d.Routes}}
+    use_backend eg_backend_{{$r.BackendID}} if { hdr(host) -i {{$d.Name}} } { path_beg {{$r.PathPrefix}} }
+    {{- end}}
+    {{- if $d.PrimaryBackendID}}
+    use_backend eg_backend_{{$d.PrimaryBackendID}} if { hdr(host) -i {{$d.Name}} }
+    {{- end}}
+    {{- end}}
     use_backend api_backend if is_acme
 
 # ── Public :443 (Customer-Backends only) ──────────────────────────────