feat(dns+ntp): DNS-Cache-Flush + NTP-Force-Sync — operative Aktionen (1.1.94)

Backend: POST /dns/flush-cache (unbound-control flush_zone .)
         POST /ntp/force-sync  (chronyc makestep)
Beide werden im Audit-Log festgehalten.
UI: Schaltflächen in DNS-Settings und NTP-Settings neben Save,
    mit Tooltip-Beschreibung + i18n (de+en).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/dns.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"log/slog"
+	"os/exec"
 
 	"github.com/gin-gonic/gin"
 
@@ -54,6 +55,7 @@ func (h *DNSHandler) Register(rg *gin.RouterGroup) {
 
 	g.GET("/settings", h.GetSettings)
 	g.PUT("/settings", h.UpdateSettings)
+	g.POST("/flush-cache", h.FlushCache)
 }
 
 // ── Zones ──────────────────────────────────────────────────────
@@ -287,6 +289,20 @@ func (h *DNSHandler) UpdateSettings(c *gin.Context) {
 	h.reload(c.Request.Context(), "settings.update")
 }
 
+// FlushCache runs `unbound-control flush_zone .` which discards all
+// cached RRs from the resolver. Useful after DNS propagation or when
+// stale records need to be evicted immediately.
+func (h *DNSHandler) FlushCache(c *gin.Context) {
+	out, err := exec.CommandContext(c.Request.Context(), "unbound-control", "flush_zone", ".").CombinedOutput()
+	if err != nil {
+		slog.Error("dns flush-cache failed", "err", err, "out", string(out))
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dns.flush-cache", "unbound", nil, h.NodeID)
+	response.OK(c, gin.H{"message": "cache flushed", "output": string(out)})
+}
+
 // ── Validation ─────────────────────────────────────────────────
 
 func validateZone(z *models.DNSZone) error {

internal/handlers/ntp.go

@@ -41,6 +41,7 @@ func (h *NTPHandler) Register(rg *gin.RouterGroup) {
 	g.GET("/settings", h.GetSettings)
 	g.PUT("/settings", h.UpdateSettings)
 	g.GET("/status", h.Status)
+	g.POST("/force-sync", h.ForceSync)
 
 	p := g.Group("/pools")
 	p.GET("", h.ListPools)
@@ -234,6 +235,21 @@ func (h *NTPHandler) DeletePool(c *gin.Context) {
 	h.reload(c.Request.Context(), "pool.delete")
 }
 
+// ForceSync runs `chronyc makestep` which immediately adjusts the
+// system clock to the current NTP reference. Useful after a long
+// outage or VM migration where the clock has drifted by more than
+// the 1ms default slew threshold.
+func (h *NTPHandler) ForceSync(c *gin.Context) {
+	out, err := exec.Command("chronyc", "makestep").CombinedOutput()
+	if err != nil {
+		slog.Error("ntp force-sync failed", "err", err, "out", string(out))
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ntp.force-sync", "chrony", nil, h.NodeID)
+	response.OK(c, gin.H{"message": "clock stepped", "output": string(out)})
+}
+
 func validateNTPPool(p *models.NTPPool) error {
 	if p.Address == "" {
 		return errors.New("address required")