feat: Network/IP-Verwaltung + Mailguard-Design-Übernahme

Backend:
* Migration 0009_networks: network_interfaces (ethernet|vlan|bond|
  bridge|wireguard, role wan|lan|dmz|mgmt|cluster, parent + vlan_id
  für VLANs) + ip_addresses (interface_id FK, address+prefix, is_vip
  + vip_priority für Cluster-Failover-VIPs).
* Repos services/networkifs + services/ipaddresses + Models +
  Handler /api/v1/network-interfaces (CRUD + /:id/ip-addresses)
  und /api/v1/ip-addresses (CRUD).
* /api/v1/system/interfaces refactored auf Go-natives net.Interfaces()
  statt `ip -j addr show` shell-out — die systemd-Sandbox blockt
  AF_NETLINK auch für Go's runtime, deswegen edgeguard-api.service
  RestrictAddressFamilies um AF_NETLINK ergänzt. Output-Shape
  bleibt identisch (ifindex, ifname, flags[], mtu, link_type,
  address, addr_info[]) — Frontend muss nicht angepasst werden.

Frontend:
* Networks-Page (/networks): "System-discovered Interfaces"
  read-only Tags-Card oben, deklarierte Interfaces unten als
  Tabelle mit Modal-CRUD; Type-Switch zeigt parent+vlan_id-Felder
  bei type=vlan; Role-Tags farbig (wan blau, lan grün, dmz orange,
  mgmt purple, cluster magenta).
* IPAddresses-Page (/ip-addresses): Tabelle pro Interface, VIP-
  Toggle blendet vip_priority-Eingabe ein. Goldenes VIP-Tag in der
  Liste.
* Sidebar erweitert um Networks + IP-Adressen + section-grouping.

Design 1:1 von mail-gateway/management-ui/ übernommen:
* enterprise.css verbatim (Inter-Font via Google CDN statt local
  woff2), Sidebar 240px dunkler Gradient #0B1426→#101D33→#0D1829,
  branding-accent #1677ff für Active-State, abgerundete Cards mit
  shadow-Token, Header weiß mit subtilem backdrop-filter.
* AntD-Theme-Tokens: colorPrimary #0EA5E9, fontSize 13, fontFamily
  'Inter', controlHeight 34, borderRadius 6.
* Layout-Komponenten neu strukturiert: AppLayout/Sidebar/Header
  matchen mailguard-Klassen-Naming (.app-layout, .main-content,
  .sidebar-section, .sidebar-menu-item.active, .header-left, …).
* Sidebar mit 4 Sektionen (Übersicht / Routing / Netzwerk / System)
  + Logo-Header + Versions-Footer.

Live-deployed auf 89.163.205.6: Networks-Endpoint listet eth0
(89.163.205.6/24, MAC bc:24:11:64:29:e8) + lo, frontend zeigt sie
als System-Tags in der Networks-Page.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

management-ui/src/i18n/locales/de/common.json

@@ -8,11 +8,54 @@
     "domains": "Domains",
     "backends": "Backends",
     "routing": "Routing",
+    "networks": "Netzwerk-Interfaces",
+    "ipAddresses": "IP-Adressen",
     "ssl": "SSL-Zertifikate",
     "vpn": "VPN",
     "firewall": "Firewall",
     "cluster": "Cluster",
-    "settings": "Einstellungen"
+    "settings": "Einstellungen",
+    "section": {
+      "overview": "Übersicht",
+      "routing": "Routing",
+      "network": "Netzwerk",
+      "system": "System"
+    }
+  },
+  "networks": {
+    "title": "Netzwerk-Interfaces",
+    "intro": "Verwalte WAN-, LAN-, VLAN- und Bond-Interfaces. Read-only-Discovery der Kernel-Interfaces oben; deklarierte Konfiguration unten — runtime-Apply via systemd-networkd folgt in einem späteren Release.",
+    "systemDiscovered": "System-Interfaces (read-only)",
+    "addInterface": "Interface hinzufügen",
+    "editInterface": "Interface bearbeiten",
+    "name": "Name",
+    "type": "Typ",
+    "parent": "Parent-Interface",
+    "vlan": "VLAN",
+    "vlanId": "VLAN-ID",
+    "role": "Rolle",
+    "mtu": "MTU",
+    "active": "Aktiv",
+    "description": "Beschreibung",
+    "actions": "Aktionen",
+    "deleteConfirm": "Interface {{name}} wirklich löschen?"
+  },
+  "ips": {
+    "title": "IP-Adressen",
+    "intro": "Adressen, die EdgeGuard verwaltet — inklusive VIPs für Cluster-Failover. Bindung an die deklarierten Interfaces oben.",
+    "addAddress": "Adresse hinzufügen",
+    "editAddress": "Adresse bearbeiten",
+    "interface": "Interface",
+    "selectInterface": "Interface wählen",
+    "address": "Adresse",
+    "prefix": "Prefix",
+    "vip": "VIP",
+    "vipFlag": "Als VIP markieren",
+    "vipPriority": "VIP-Priorität (Cluster-Failover)",
+    "active": "Aktiv",
+    "description": "Beschreibung",
+    "actions": "Aktionen",
+    "deleteConfirm": "Adresse {{addr}} wirklich löschen?"
   },
   "auth": {
     "loginTitle": "Anmelden",

management-ui/src/i18n/locales/en/common.json

@@ -8,11 +8,54 @@
     "domains": "Domains",
     "backends": "Backends",
     "routing": "Routing",
+    "networks": "Network interfaces",
+    "ipAddresses": "IP addresses",
     "ssl": "SSL certificates",
     "vpn": "VPN",
     "firewall": "Firewall",
     "cluster": "Cluster",
-    "settings": "Settings"
+    "settings": "Settings",
+    "section": {
+      "overview": "Overview",
+      "routing": "Routing",
+      "network": "Network",
+      "system": "System"
+    }
+  },
+  "networks": {
+    "title": "Network interfaces",
+    "intro": "Manage WAN, LAN, VLAN and bond interfaces. Read-only kernel discovery above; declared configuration below — runtime apply via systemd-networkd lands in a later release.",
+    "systemDiscovered": "System interfaces (read-only)",
+    "addInterface": "Add interface",
+    "editInterface": "Edit interface",
+    "name": "Name",
+    "type": "Type",
+    "parent": "Parent interface",
+    "vlan": "VLAN",
+    "vlanId": "VLAN ID",
+    "role": "Role",
+    "mtu": "MTU",
+    "active": "Active",
+    "description": "Description",
+    "actions": "Actions",
+    "deleteConfirm": "Really delete interface {{name}}?"
+  },
+  "ips": {
+    "title": "IP addresses",
+    "intro": "Addresses managed by EdgeGuard — including VIPs that follow the active cluster node on failover.",
+    "addAddress": "Add address",
+    "editAddress": "Edit address",
+    "interface": "Interface",
+    "selectInterface": "Select interface",
+    "address": "Address",
+    "prefix": "Prefix",
+    "vip": "VIP",
+    "vipFlag": "Mark as VIP",
+    "vipPriority": "VIP priority (cluster failover)",
+    "active": "Active",
+    "description": "Description",
+    "actions": "Actions",
+    "deleteConfirm": "Really delete address {{addr}}?"
   },
   "auth": {
     "loginTitle": "Sign in",