feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

Initialer Schema-Set (8 Migrationen, 13 Tabellen) für EdgeGuard v1:
users + audit_log + system_settings, ha_nodes, backends/domains/
routing_rules/tls_certs, forward_proxy_acls, wireguard_peers,
firewall_rules, dns_zones/dns_records, licenses. Migrations liegen
in internal/database/migrations/ (analog mail-gateway) und werden
per //go:embed ins Binary gepackt — keine separate SQL-Dateien im
.deb. ValidateMigrations + Test schützen vor Duplicate-Versionen
(mail-gateway 2026-05-08-Vorfall). GORM-Models für alle Tabellen,
sensible Felder (password_hash, private_key_enc) sind json:"-".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/models/wireguard_peer.go

@@ -0,0 +1,23 @@
+package models
+
+import "time"
+
+type WireGuardPeer struct {
+	ID                  int64      `gorm:"primaryKey"                       json:"id"`
+	Name                string     `gorm:"column:name;uniqueIndex"          json:"name"`
+	PeerType            string     `gorm:"column:peer_type"                 json:"peer_type"`
+	PublicKey           string     `gorm:"column:public_key;uniqueIndex"    json:"public_key"`
+	PrivateKeyEnc       *string    `gorm:"column:private_key_enc"           json:"-"`
+	PresharedKeyEnc     *string    `gorm:"column:preshared_key_enc"         json:"-"`
+	AllowedIPs          string     `gorm:"column:allowed_ips"               json:"allowed_ips"`
+	Endpoint            *string    `gorm:"column:endpoint"                  json:"endpoint,omitempty"`
+	ListenPort          *int       `gorm:"column:listen_port"               json:"listen_port,omitempty"`
+	PersistentKeepalive *int       `gorm:"column:persistent_keepalive"      json:"persistent_keepalive,omitempty"`
+	LastHandshakeAt     *time.Time `gorm:"column:last_handshake_at"         json:"last_handshake_at,omitempty"`
+	Active              bool       `gorm:"column:active"                    json:"active"`
+	Notes               *string    `gorm:"column:notes"                     json:"notes,omitempty"`
+	CreatedAt           time.Time  `gorm:"column:created_at"                json:"created_at"`
+	UpdatedAt           time.Time  `gorm:"column:updated_at"                json:"updated_at"`
+}
+
+func (WireGuardPeer) TableName() string { return "wireguard_peers" }