feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

Initialer Schema-Set (8 Migrationen, 13 Tabellen) für EdgeGuard v1:
users + audit_log + system_settings, ha_nodes, backends/domains/
routing_rules/tls_certs, forward_proxy_acls, wireguard_peers,
firewall_rules, dns_zones/dns_records, licenses. Migrations liegen
in internal/database/migrations/ (analog mail-gateway) und werden
per //go:embed ins Binary gepackt — keine separate SQL-Dateien im
.deb. ValidateMigrations + Test schützen vor Duplicate-Versionen
(mail-gateway 2026-05-08-Vorfall). GORM-Models für alle Tabellen,
sensible Felder (password_hash, private_key_enc) sind json:"-".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/database/migrations_unique_test.go

@@ -0,0 +1,19 @@
+package database
+
+import "testing"
+
+// TestEmbeddedMigrationsUnique guards against duplicate migration
+// version prefixes. mail-gateway hit this on 2026-05-08 when two
+// parallel agents both committed a 0092_*.sql; goose panicked at
+// startup, the API restart-looped, the cluster rolling-upgrade hung.
+//
+// Cheap assertion that runs as part of `go test ./...` — fails the
+// build before `make deb` ever produces an artefact, so the bad
+// version never reaches the APT registry. Same logic also runs at
+// service start via Migrate() and via `edgeguard-ctl migrate check`
+// in postinst (defense in depth).
+func TestEmbeddedMigrationsUnique(t *testing.T) {
+	if err := ValidateMigrations(); err != nil {
+		t.Fatalf("embedded migrations failed validation: %v", err)
+	}
+}