feat: Network/IP-Verwaltung + Mailguard-Design-Übernahme

Backend:
* Migration 0009_networks: network_interfaces (ethernet|vlan|bond|
  bridge|wireguard, role wan|lan|dmz|mgmt|cluster, parent + vlan_id
  für VLANs) + ip_addresses (interface_id FK, address+prefix, is_vip
  + vip_priority für Cluster-Failover-VIPs).
* Repos services/networkifs + services/ipaddresses + Models +
  Handler /api/v1/network-interfaces (CRUD + /:id/ip-addresses)
  und /api/v1/ip-addresses (CRUD).
* /api/v1/system/interfaces refactored auf Go-natives net.Interfaces()
  statt `ip -j addr show` shell-out — die systemd-Sandbox blockt
  AF_NETLINK auch für Go's runtime, deswegen edgeguard-api.service
  RestrictAddressFamilies um AF_NETLINK ergänzt. Output-Shape
  bleibt identisch (ifindex, ifname, flags[], mtu, link_type,
  address, addr_info[]) — Frontend muss nicht angepasst werden.

Frontend:
* Networks-Page (/networks): "System-discovered Interfaces"
  read-only Tags-Card oben, deklarierte Interfaces unten als
  Tabelle mit Modal-CRUD; Type-Switch zeigt parent+vlan_id-Felder
  bei type=vlan; Role-Tags farbig (wan blau, lan grün, dmz orange,
  mgmt purple, cluster magenta).
* IPAddresses-Page (/ip-addresses): Tabelle pro Interface, VIP-
  Toggle blendet vip_priority-Eingabe ein. Goldenes VIP-Tag in der
  Liste.
* Sidebar erweitert um Networks + IP-Adressen + section-grouping.

Design 1:1 von mail-gateway/management-ui/ übernommen:
* enterprise.css verbatim (Inter-Font via Google CDN statt local
  woff2), Sidebar 240px dunkler Gradient #0B1426→#101D33→#0D1829,
  branding-accent #1677ff für Active-State, abgerundete Cards mit
  shadow-Token, Header weiß mit subtilem backdrop-filter.
* AntD-Theme-Tokens: colorPrimary #0EA5E9, fontSize 13, fontFamily
  'Inter', controlHeight 34, borderRadius 6.
* Layout-Komponenten neu strukturiert: AppLayout/Sidebar/Header
  matchen mailguard-Klassen-Naming (.app-layout, .main-content,
  .sidebar-section, .sidebar-menu-item.active, .header-left, …).
* Sidebar mit 4 Sektionen (Übersicht / Routing / Netzwerk / System)
  + Logo-Header + Versions-Footer.

Live-deployed auf 89.163.205.6: Networks-Endpoint listet eth0
(89.163.205.6/24, MAC bc:24:11:64:29:e8) + lo, frontend zeigt sie
als System-Tags in der Networks-Page.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/handlers/system.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -30,6 +31,7 @@ func (h *SystemHandler) Register(rg *gin.RouterGroup) {
 	g.GET("/health", h.Health)
 	g.GET("/package-versions", h.PackageVersions)
 	g.POST("/upgrade", h.Upgrade)
+	g.GET("/interfaces", h.Interfaces)
 }
 
 func (h *SystemHandler) Health(c *gin.Context) {
@@ -116,6 +118,108 @@ rm -f /tmp/edgeguard-upgrade.sh
 	})
 }
 
+// addrInfo + interfaceInfo mirror the relevant subset of `ip -j addr
+// show` so the frontend keeps its existing parsing code.
+type addrInfo struct {
+	Family    string `json:"family"` // "inet" | "inet6"
+	Local     string `json:"local"`
+	PrefixLen int    `json:"prefixlen"`
+}
+
+type interfaceInfo struct {
+	IfIndex  int        `json:"ifindex"`
+	IfName   string     `json:"ifname"`
+	Flags    []string   `json:"flags"`
+	MTU      int        `json:"mtu"`
+	LinkType string     `json:"link_type,omitempty"`
+	Address  string     `json:"address,omitempty"`
+	AddrInfo []addrInfo `json:"addr_info"`
+}
+
+// Interfaces enumerates the kernel-side network interfaces using
+// Go's net.Interfaces() — no shell-out, no AF_NETLINK exception
+// in the systemd hardening required (the original `ip -j addr`
+// approach was blocked by RestrictAddressFamilies).
+//
+// Output shape mirrors `ip -j addr show` enough for the UI's
+// Networks "system-discovered" card.
+func (h *SystemHandler) Interfaces(c *gin.Context) {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		slog.Warn("system/interfaces: net.Interfaces failed", "error", err)
+		response.OK(c, gin.H{"interfaces": []interfaceInfo{}})
+		return
+	}
+	out := make([]interfaceInfo, 0, len(ifaces))
+	for _, ifc := range ifaces {
+		info := interfaceInfo{
+			IfIndex:  ifc.Index,
+			IfName:   ifc.Name,
+			MTU:      ifc.MTU,
+			Address:  ifc.HardwareAddr.String(),
+			LinkType: classifyLinkType(ifc),
+			Flags:    flagsToList(ifc.Flags),
+			AddrInfo: []addrInfo{},
+		}
+		addrs, err := ifc.Addrs()
+		if err != nil {
+			out = append(out, info)
+			continue
+		}
+		for _, a := range addrs {
+			ipnet, ok := a.(*net.IPNet)
+			if !ok {
+				continue
+			}
+			family := "inet"
+			if ipnet.IP.To4() == nil {
+				family = "inet6"
+			}
+			ones, _ := ipnet.Mask.Size()
+			info.AddrInfo = append(info.AddrInfo, addrInfo{
+				Family:    family,
+				Local:     ipnet.IP.String(),
+				PrefixLen: ones,
+			})
+		}
+		out = append(out, info)
+	}
+	response.OK(c, gin.H{"interfaces": out})
+}
+
+func classifyLinkType(ifc net.Interface) string {
+	if ifc.Flags&net.FlagLoopback != 0 {
+		return "loopback"
+	}
+	if len(ifc.HardwareAddr) > 0 {
+		return "ether"
+	}
+	return ""
+}
+
+func flagsToList(f net.Flags) []string {
+	var out []string
+	if f&net.FlagUp != 0 {
+		out = append(out, "UP")
+	}
+	if f&net.FlagBroadcast != 0 {
+		out = append(out, "BROADCAST")
+	}
+	if f&net.FlagLoopback != 0 {
+		out = append(out, "LOOPBACK")
+	}
+	if f&net.FlagPointToPoint != 0 {
+		out = append(out, "POINTOPOINT")
+	}
+	if f&net.FlagMulticast != 0 {
+		out = append(out, "MULTICAST")
+	}
+	if f&net.FlagRunning != 0 {
+		out = append(out, "LOWER_UP")
+	}
+	return out
+}
+
 // parseAptPolicy extracts "Installed: x" and "Candidate: y" from
 // apt-cache policy output. Both can be "(none)"; we normalise that to
 // empty string.