feat(dns): Resolver stats tab + NAT rule move buttons

- GET /dns/stats via unbound-control stats_noreset: total queries,
  cache hits/miss, hit-rate progress bar, recursive replies, prefetch,
  rate-limited, unwanted, RRset/msg cache memory
- DNS page: new "Resolver stats" tab with 30s auto-refresh
- NAT rules: ↑↓ move buttons (same pattern as firewall rules 1.1.102)

v1.1.103

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/en/common.json

@@ -883,7 +883,23 @@
   "dns": {
     "title": "DNS (Unbound)",
     "intro": "Unbound resolver on :53. Local zones (authoritative from DNS records) and forward zones (stub-zone to remote resolvers). Default forwarders catch everything else.",
-    "tabs": { "zones": "Zones", "settings": "Resolver settings" },
+    "tabs": { "zones": "Zones", "settings": "Resolver settings", "stats": "Resolver stats" },
+    "statsCard": {
+      "title": "Resolver statistics (unbound-control stats_noreset)",
+      "totalQueries": "Total queries",
+      "cacheHits": "Cache hits",
+      "cacheMiss": "Cache miss",
+      "cacheHitPct": "Cache hit rate",
+      "recursiveReplies": "Recursive replies",
+      "prefetch": "Prefetch",
+      "rateLimited": "Rate-limited",
+      "rrsetCacheBytes": "RRset cache",
+      "msgCacheBytes": "Msg cache",
+      "tcpUsage": "TCP connections",
+      "unwanted": "Unwanted queries",
+      "empty": "No stats available — is unbound running?",
+      "sinceRestart": "Since last restart"
+    },
     "zone": {
       "name": "Zone name",
       "nameExtra": "FQDN without leading/trailing dot — e.g. internal.netcell-it.de",