feat(crowdsec): UI-Schalter „vertrauenswürdiges Admin-Panel" → gerenderte CrowdSec-Whitelist — v1.3.19

Pro-Domain-Flag crowdsec_trusted (Migration 0048). Ist es gesetzt, rendert der
neue crowdsec-whitelist-Generator den Hostname host-genau in
/etc/crowdsec/parsers/s02-enrich/edgeguard-admin-hosts-whitelist.yaml
(evt.Parsed.http_host) und reloadet crowdsec. Löst das Problem, dass Admin-SPAs
(viele /api/-Requests pro Aktion) http-crawl-non_statics triggern und die
Admin-IP bannen — jetzt im Frontend steuerbar statt manueller Node-Datei.

- Generator internal/crowdsec/whitelist.go (configgen.Generator, no-op ohne
  CrowdSec), registriert in edgeguard-ctl render-config + in den Domains-Reloader
  komponiert (Domain-Edit → Whitelist re-render). Aus der replizierten DB
  gerendert → überlebt Node-Neuaufbau (Ersatz für die manuelle Node-Datei).
- postinst: sudoers reload crowdsec + edgeguard-owned Whitelist-Datei anlegen
  (dir root-owned → Generator überschreibt nur die vorab-chownte Datei) +
  Initial-Render.
- UI: Switch „Vertrauenswürdiges Admin-Panel" im Domain-Detail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/services/domains/domains.go

@@ -24,7 +24,7 @@ SELECT id, name, active, primary_backend_id, http_to_https,
        hsts_enabled, hsts_max_age, hsts_subdomains, hsts_preload,
        maintenance_mode, maintenance_message, www_redirect,
        rate_limit_rps, max_body_kb, disable_h3,
-       notes, redirect_to, created_at, updated_at
+       notes, redirect_to, crowdsec_trusted, created_at, updated_at
 FROM domains
 `
 
@@ -65,17 +65,19 @@ func (r *Repo) Create(ctx context.Context, d models.Domain) (*models.Domain, err
 INSERT INTO domains (name, active, primary_backend_id, http_to_https,
                      hsts_enabled, hsts_max_age, hsts_subdomains, hsts_preload,
                      maintenance_mode, maintenance_message, www_redirect,
-                     rate_limit_rps, max_body_kb, disable_h3, notes, redirect_to)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
+                     rate_limit_rps, max_body_kb, disable_h3, notes, redirect_to,
+                     crowdsec_trusted)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17)
 RETURNING id, name, active, primary_backend_id, http_to_https,
           hsts_enabled, hsts_max_age, hsts_subdomains, hsts_preload,
           maintenance_mode, maintenance_message, www_redirect,
           rate_limit_rps, max_body_kb, disable_h3,
-          notes, redirect_to, created_at, updated_at`,
+          notes, redirect_to, crowdsec_trusted, created_at, updated_at`,
 		d.Name, d.Active, d.PrimaryBackendID, d.HTTPToHTTPS,
 		d.HSTSEnabled, d.HSTSMaxAge, d.HSTSSubdomains, d.HSTSPreload,
 		d.MaintenanceMode, d.MaintenanceMessage, d.WWWRedirect,
-		d.RateLimitRPS, d.MaxBodyKB, d.DisableH3, d.Notes, d.RedirectTo)
+		d.RateLimitRPS, d.MaxBodyKB, d.DisableH3, d.Notes, d.RedirectTo,
+		d.CrowdSecTrusted)
 	return scanDomain(row)
 }
 
@@ -101,17 +103,19 @@ UPDATE domains SET
    disable_h3 = $14,
    notes = $15,
    redirect_to = $16,
+   crowdsec_trusted = $17,
    updated_at = NOW()
-WHERE id = $17
+WHERE id = $18
 RETURNING id, name, active, primary_backend_id, http_to_https,
           hsts_enabled, hsts_max_age, hsts_subdomains, hsts_preload,
           maintenance_mode, maintenance_message, www_redirect,
           rate_limit_rps, max_body_kb, disable_h3,
-          notes, redirect_to, created_at, updated_at`,
+          notes, redirect_to, crowdsec_trusted, created_at, updated_at`,
 		d.Name, d.Active, d.PrimaryBackendID, d.HTTPToHTTPS,
 		d.HSTSEnabled, d.HSTSMaxAge, d.HSTSSubdomains, d.HSTSPreload,
 		d.MaintenanceMode, d.MaintenanceMessage, d.WWWRedirect,
-		d.RateLimitRPS, d.MaxBodyKB, d.DisableH3, d.Notes, d.RedirectTo, id)
+		d.RateLimitRPS, d.MaxBodyKB, d.DisableH3, d.Notes, d.RedirectTo,
+		d.CrowdSecTrusted, id)
 	out, err := scanDomain(row)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
@@ -140,7 +144,7 @@ func scanDomain(row interface{ Scan(...any) error }) (*models.Domain, error) {
 		&d.HSTSEnabled, &d.HSTSMaxAge, &d.HSTSSubdomains, &d.HSTSPreload,
 		&d.MaintenanceMode, &d.MaintenanceMessage, &d.WWWRedirect,
 		&d.RateLimitRPS, &d.MaxBodyKB, &d.DisableH3,
-		&d.Notes, &d.RedirectTo, &d.CreatedAt, &d.UpdatedAt,
+		&d.Notes, &d.RedirectTo, &d.CrowdSecTrusted, &d.CreatedAt, &d.UpdatedAt,
 	); err != nil {
 		return nil, err
 	}