feat: Networks-Members für bridge/bond + System-Rules-Card + Theme-Revert

* Migration 0011: members JSONB für network_interfaces. Bridge/bond
  brauchen ≥1 Member (NOT VALID-Constraint, schont bestehende Rows).
  vlan/wireguard/ethernet ignorieren das Feld.
* Backend-Validation pro Typ: vlan→parent+vlan_id, bridge/bond→members,
  ethernet/wireguard→keins. Repo serialisiert via JSONB.
* Form Networks: Members-Multi-Select für bridge/bond, Composition-
  Spalte zeigt vlan-tag bzw. Member-Liste.
* Firewall-Rules-Tab zeigt jetzt SystemRulesCard ganz oben — Anti-
  Lockout (SSH/443), stateful baseline, default-deny-Erklärung.
* Theme-Tokens 1:1 mail-gateway: fontSize 13, controlHeight 34
  (vorher zu dichtes 12/28). Density kommt vom DataTable size="small".
* Makefile publish-amd64 lädt jetzt auch edgeguard-ui_*_all.deb und
  edgeguard_*_all.deb hoch (vorher nur api).
* Version 1.0.0 → 1.0.3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Makefile

@@ -87,10 +87,11 @@ GITEA_DEB_URL := https://git.netcell-it.de/api/packages/projekte/debian/pool/tri
 publish-amd64: deb-amd64
 	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \
 	if [ -z "$$TOK" ]; then echo "publish: ~/.gitea-token is empty"; exit 1; fi; \
-	echo "  -> publish edgeguard-api_$(VERSION)_amd64.deb"; \
-	curl -sS -H "Authorization: token $$TOK" \
-	    --upload-file build/deb/edgeguard-api_$(VERSION)_amd64.deb \
-	    $(GITEA_DEB_URL)
+	for f in edgeguard-api_$(VERSION)_amd64.deb edgeguard-ui_$(VERSION)_all.deb edgeguard_$(VERSION)_all.deb; do \
+	  echo "  -> publish $$f"; \
+	  curl -sS -H "Authorization: token $$TOK" --upload-file build/deb/$$f $(GITEA_DEB_URL); \
+	  echo ""; \
+	done
 
 publish-arm64: deb-arm64
 	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \