feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

Initialer Schema-Set (8 Migrationen, 13 Tabellen) für EdgeGuard v1:
users + audit_log + system_settings, ha_nodes, backends/domains/
routing_rules/tls_certs, forward_proxy_acls, wireguard_peers,
firewall_rules, dns_zones/dns_records, licenses. Migrations liegen
in internal/database/migrations/ (analog mail-gateway) und werden
per //go:embed ins Binary gepackt — keine separate SQL-Dateien im
.deb. ValidateMigrations + Test schützen vor Duplicate-Versionen
(mail-gateway 2026-05-08-Vorfall). GORM-Models für alle Tabellen,
sensible Felder (password_hash, private_key_enc) sind json:"-".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/models/license.go

@@ -0,0 +1,22 @@
+package models
+
+import (
+	"encoding/json"
+	"time"
+)
+
+type License struct {
+	ID                     int64           `gorm:"primaryKey"                          json:"id"`
+	LicenseKey             string          `gorm:"column:license_key;uniqueIndex"      json:"license_key"`
+	Status                 string          `gorm:"column:status"                       json:"status"`
+	ValidUntil             *time.Time      `gorm:"column:valid_until"                  json:"valid_until,omitempty"`
+	LastVerifiedAt         *time.Time      `gorm:"column:last_verified_at"             json:"last_verified_at,omitempty"`
+	LastVerifiedNode       *string         `gorm:"column:last_verified_node"           json:"last_verified_node,omitempty"`
+	ActiveDomainsAtVerify  *int            `gorm:"column:active_domains_at_verify"     json:"active_domains_at_verify,omitempty"`
+	Payload                json.RawMessage `gorm:"column:payload;type:jsonb"           json:"payload,omitempty"`
+	LastError              *string         `gorm:"column:last_error"                   json:"last_error,omitempty"`
+	CreatedAt              time.Time       `gorm:"column:created_at"                   json:"created_at"`
+	UpdatedAt              time.Time       `gorm:"column:updated_at"                   json:"updated_at"`
+}
+
+func (License) TableName() string { return "licenses" }