feat: Networks-Members für bridge/bond + System-Rules-Card + Theme-Revert

* Migration 0011: members JSONB für network_interfaces. Bridge/bond
  brauchen ≥1 Member (NOT VALID-Constraint, schont bestehende Rows).
  vlan/wireguard/ethernet ignorieren das Feld.
* Backend-Validation pro Typ: vlan→parent+vlan_id, bridge/bond→members,
  ethernet/wireguard→keins. Repo serialisiert via JSONB.
* Form Networks: Members-Multi-Select für bridge/bond, Composition-
  Spalte zeigt vlan-tag bzw. Member-Liste.
* Firewall-Rules-Tab zeigt jetzt SystemRulesCard ganz oben — Anti-
  Lockout (SSH/443), stateful baseline, default-deny-Erklärung.
* Theme-Tokens 1:1 mail-gateway: fontSize 13, controlHeight 34
  (vorher zu dichtes 12/28). Density kommt vom DataTable size="small".
* Makefile publish-amd64 lädt jetzt auch edgeguard-ui_*_all.deb und
  edgeguard_*_all.deb hoch (vorher nur api).
* Version 1.0.0 → 1.0.3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/database/migrations/0011_network_members.sql

@@ -0,0 +1,31 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Multi-member support for bridge/bond. `parent` (single TEXT) was
+-- enough for VLANs but bridges and bonds aggregate N kernel ifaces.
+-- We store the member-list as a JSONB array of iface-names so the
+-- runtime renderer can emit the correct systemd-networkd .network
+-- files (Bridge=br0 on each member etc.).
+ALTER TABLE network_interfaces
+    ADD COLUMN IF NOT EXISTS members JSONB NOT NULL DEFAULT '[]'::jsonb;
+
+-- Bridge and bond MUST have ≥ 1 member; vlan/wireguard/ethernet
+-- ignore the field. NOT VALID skips the back-fill check on the
+-- existing rows — they may have been declared in an earlier release
+-- before the field existed and we don't want to break the upgrade.
+-- Inserts and UPDATEs from now on are validated normally.
+ALTER TABLE network_interfaces
+    DROP CONSTRAINT IF EXISTS network_interfaces_members_check;
+ALTER TABLE network_interfaces
+    ADD  CONSTRAINT network_interfaces_members_check CHECK (
+        type NOT IN ('bridge', 'bond')
+        OR jsonb_array_length(members) >= 1
+    ) NOT VALID;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE network_interfaces DROP CONSTRAINT IF EXISTS network_interfaces_members_check;
+ALTER TABLE network_interfaces DROP COLUMN IF EXISTS members;
+-- +goose StatementEnd