feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

Initialer Schema-Set (8 Migrationen, 13 Tabellen) für EdgeGuard v1:
users + audit_log + system_settings, ha_nodes, backends/domains/
routing_rules/tls_certs, forward_proxy_acls, wireguard_peers,
firewall_rules, dns_zones/dns_records, licenses. Migrations liegen
in internal/database/migrations/ (analog mail-gateway) und werden
per //go:embed ins Binary gepackt — keine separate SQL-Dateien im
.deb. ValidateMigrations + Test schützen vor Duplicate-Versionen
(mail-gateway 2026-05-08-Vorfall). GORM-Models für alle Tabellen,
sensible Felder (password_hash, private_key_enc) sind json:"-".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -132,6 +132,8 @@ cd management-ui && bun run dev
 │   ├── edgeguard-scheduler/   # Cron-Jobs
 │   └── edgeguard-ctl/         # CLI
 ├── internal/
+│   ├── database/              # pgxpool + goose-Runner; migrations/ via go:embed
+│   │   └── migrations/        # SQL (goose-Format) — embedded ins Binary
 │   ├── models/                # GORM-Models
 │   ├── handlers/              # HTTP-Handler (REST)
 │   ├── services/              # Business-Logik
@@ -146,7 +148,6 @@ cd management-ui && bun run dev
 │   ├── aggregator/            # Cluster-View APIs
 │   └── license/               # Lizenz-Validierung
 ├── management-ui/             # React 19 + AntD 6 (1:1 enconf-Pattern)
-├── migrations/                # SQL (goose-Format)
 ├── packaging/debian/          # control, postinst, postrm, systemd-Units
 ├── deploy/
 │   ├── systemd/               # *.service, *.target, *.timer
@@ -171,7 +172,7 @@ cd management-ui && bun run dev
 ## Key Conventions
 
 ### Go-Code
-- **Migrations:** goose SQL-Dateien in `migrations/` — NICHT GORM AutoMigrate
+- **Migrations:** goose SQL-Dateien in `internal/database/migrations/`, via `//go:embed` ins Binary — NICHT GORM AutoMigrate
 - **ORM:** GORM für Queries, nicht für Schema-Verwaltung
 - **Config-Generierung:** Template-Datei in `deploy/*/`, Generator in `internal/*/`
 - **Config-Reload:** `systemctl reload <service>` nach Config-Schreiben