feat(dhcp): DHCPv4-Server via Kea (kea-dhcp4-server) — v1.2.92

Verwalteter DHCPv4-Server analog Unbound/Squid/Chrony.
- Migration 0041: dhcp_settings (singleton, node-lokal), dhcp_subnets, dhcp_reservations.
- internal/kea: Renderer baut Kea-JSON via Go-Struct→Marshal (garantiert valide), managed /etc/edgeguard/kea/kea-dhcp4.conf (Symlink von /etc/kea), Service-Lifecycle an enabled gekoppelt (default AUS, kein rogue DHCP). Interface per NAME (cluster-sicher, kein node-lokaler FK).
- internal/services/dhcp + internal/handlers/dhcp.go: Settings + Subnet/Reservation-CRUD, Validierung (CIDR/IP/MAC/interface exists).
- configgen: Stop/Enable/DisableService. Firewall: AutoFWRule.Iface → udp/67 pro LAN-Interface gescopt (kein WAN). Cluster: subnets/reservations repliziert (hashSpec), dhcp_settings node-lokal (localOnlyTables).
- main.go + render.go + WithAllReloaders Wiring. Packaging: kea-dhcp4-server Dependency, /etc/edgeguard/kea Dir, Symlink, disable-on-install, sudoers (restart/stop/enable/disable).
- UI: DHCP-Seite (Settings + Subnets + Reservierungen pro Subnet), Route/Nav/i18n de/en, HA-Warnung 'nur auf einer Node aktivieren'.
- Tests (guarded EG_FWTEST_DSN): Kea-Renderer gegen DB (valides JSON + Felder), FW-Auto-Rule-Iface inkl. nft -c. Scope v1: DHCPv4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/firewall/firewall_e2e_test.go

@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"strings"
 	"testing"
+	"time"
 
 	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
 )
@@ -19,8 +20,17 @@ func TestE2E_IPv6Render(t *testing.T) {
 		t.Skip("set EG_FWTEST_DSN to run the firewall end-to-end test")
 	}
 	ctx := context.Background()
-	if err := database.Migrate(ctx, dsn); err != nil {
-		t.Fatalf("migrate: %v", err)
+	// Retry: goose-Erst-Apply ist nicht concurrency-safe, wenn mehrere
+	// guarded Test-Pakete dieselbe frische DB parallel migrieren.
+	var mErr error
+	for i := 0; i < 3; i++ {
+		if mErr = database.Migrate(ctx, dsn); mErr == nil {
+			break
+		}
+		time.Sleep(700 * time.Millisecond)
+	}
+	if mErr != nil {
+		t.Fatalf("migrate: %v", mErr)
 	}
 	pool, err := database.Open(ctx, dsn)
 	if err != nil {