feat(dns): Resolver stats tab + NAT rule move buttons

- GET /dns/stats via unbound-control stats_noreset: total queries,
  cache hits/miss, hit-rate progress bar, recursive replies, prefetch,
  rate-limited, unwanted, RRset/msg cache memory
- DNS page: new "Resolver stats" tab with 30s auto-refresh
- NAT rules: ↑↓ move buttons (same pattern as firewall rules 1.1.102)

v1.1.103

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/de/common.json

@@ -883,7 +883,23 @@
   "dns": {
     "title": "DNS (Unbound)",
     "intro": "Unbound-Resolver auf :53. Lokale Zonen (authoritativ aus DNS-Records) und Forward-Zonen (per stub-zone weiter zu fremden Resolvern). Default-Forwarder für alles andere.",
-    "tabs": { "zones": "Zonen", "settings": "Resolver-Settings" },
+    "tabs": { "zones": "Zonen", "settings": "Resolver-Settings", "stats": "Resolver-Stats" },
+    "statsCard": {
+      "title": "Resolver-Statistiken (unbound-control stats_noreset)",
+      "totalQueries": "Abfragen gesamt",
+      "cacheHits": "Cache-Treffer",
+      "cacheMiss": "Cache-Miss",
+      "cacheHitPct": "Cache-Trefferrate",
+      "recursiveReplies": "Rekursive Antworten",
+      "prefetch": "Prefetch",
+      "rateLimited": "Rate-Limited",
+      "rrsetCacheBytes": "RRset-Cache",
+      "msgCacheBytes": "Msg-Cache",
+      "tcpUsage": "TCP-Verbindungen",
+      "unwanted": "Unerwünschte Anfragen",
+      "empty": "Keine Statistiken — läuft unbound?",
+      "sinceRestart": "Seit letztem Neustart"
+    },
     "zone": {
       "name": "Zone-Name",
       "nameExtra": "FQDN ohne führenden/abschließenden Punkt — z.B. internal.netcell-it.de",