feat(ui): Quick-Toggles, Config-Preview, Dashboard-Alerts, Domain-Detail-Health

Quick-Toggle-Switches (kein Modal nötig) für: Backends, Backend-Server,
DNS-Zonen, DNS-Records, Domains (active), Firewall-Rules, NAT-Rules,
Forward-Proxy ACLs, Routing-Rules.

Dashboard: Alert-Banner für komplett ausgefallene Backends (HAProxy-Stats)
und Domains im Maintenance-Mode.

Domain-Detail: HAProxy-Live-Health-Badge (15s Polling), TLS-Cert
ausstellen/erneuern direkt aus dem Detail, Routing-Rules-Panel inline.

Config-Preview (Settings): alle 4 Generatoren (haproxy, nftables, squid,
unbound) rendern via RenderToString ohne Disk-Write — GET /system/config-preview.

ActionButtons: Viewer-Rolle blendet Delete aus (RBAC-Ergänzung).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/firewall/firewall.go

@@ -52,6 +52,18 @@ func New(pool *pgxpool.Pool) *Generator { return &Generator{Pool: pool} }
 
 func (g *Generator) Name() string { return "nftables" }
 
+func (g *Generator) RenderToString(ctx context.Context) (string, error) {
+	view, err := g.loadView(ctx)
+	if err != nil {
+		return "", fmt.Errorf("nftables: load state: %w", err)
+	}
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, view); err != nil {
+		return "", fmt.Errorf("nftables: render template: %w", err)
+	}
+	return buf.String(), nil
+}
+
 func (g *Generator) Render(ctx context.Context) error {
 	view, err := g.loadView(ctx)
 	if err != nil {