feat(dns+ntp): DNS-Cache-Flush + NTP-Force-Sync — operative Aktionen (1.1.94)

Backend: POST /dns/flush-cache (unbound-control flush_zone .)
         POST /ntp/force-sync  (chronyc makestep)
Beide werden im Audit-Log festgehalten.
UI: Schaltflächen in DNS-Settings und NTP-Settings neben Save,
    mit Tooltip-Beschreibung + i18n (de+en).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/ntp.go

@@ -41,6 +41,7 @@ func (h *NTPHandler) Register(rg *gin.RouterGroup) {
 	g.GET("/settings", h.GetSettings)
 	g.PUT("/settings", h.UpdateSettings)
 	g.GET("/status", h.Status)
+	g.POST("/force-sync", h.ForceSync)
 
 	p := g.Group("/pools")
 	p.GET("", h.ListPools)
@@ -234,6 +235,21 @@ func (h *NTPHandler) DeletePool(c *gin.Context) {
 	h.reload(c.Request.Context(), "pool.delete")
 }
 
+// ForceSync runs `chronyc makestep` which immediately adjusts the
+// system clock to the current NTP reference. Useful after a long
+// outage or VM migration where the clock has drifted by more than
+// the 1ms default slew threshold.
+func (h *NTPHandler) ForceSync(c *gin.Context) {
+	out, err := exec.Command("chronyc", "makestep").CombinedOutput()
+	if err != nil {
+		slog.Error("ntp force-sync failed", "err", err, "out", string(out))
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ntp.force-sync", "chrony", nil, h.NodeID)
+	response.OK(c, gin.H{"message": "clock stepped", "output": string(out)})
+}
+
 func validateNTPPool(p *models.NTPPool) error {
 	if p.Address == "" {
 		return errors.New("address required")