feat(ui): Pages auf neues Design + Dashboard + WG-Live-Status + Routing-Rules-Verstecken

Pages auf PageHeader/StatusDot/ActionButtons-Pattern migriert:
* Dashboard — Komplett-Rewrite. KPI-Tiles (Domains, Backends, Iface,
  FW-Rules, NAT, WG), Detail-Cards (WireGuard live status, Firewall
  zone overview, SSL expiring soon, Cluster nodes, Routing summary,
  System info). Polled queries pro Card.
* Domains, Backends, RoutingRules, Networks, IPAddresses, SSL,
  Cluster, Settings, Firewall (index) — alle inline Action-Buttons
  → ActionButtons; alle Yes/No-Renders → StatusDot; Add-Button in
  DataTable.extraActions; PageHeader oben.

WireGuard
---------
* Neuer /wireguard/status-Endpoint parsed `wg show all dump`,
  liefert {iface, peer_pubkey, endpoint, last_handshake_unix, rx, tx}.
  Sudoers im postinst um `wg show` erweitert.
* Server-Drawer Peer-Liste zeigt jetzt Live-Status (Online/Offline-
  Dot, "vor Xs", Traffic-Counter) per 10s-Polling. Importierte
  "Unify Home" peer kann jetzt im UI verifiziert werden.
* Importer-Bug fixed: nextName ("# Unify Home" comment) wurde beim
  Sektionswechsel zu früh geresettet — jetzt nur nach echtem
  flushPeer.

Routing-Rules
-------------
* Aus Sidebar entfernt. URL bleibt funktional, aber für 90% der
  Setups reicht domains.primary_backend_id (das HAProxy ohnehin
  als default_backend rendert). Path-basiertes Routing ist ein
  Advanced-Feature und kommt später als Domain-Modal-Tab zurück.
* nav.routing-Sidebar-Eintrag + BranchesOutlined-Import entfernt.

Misc
----
* "Firewall (v2)" → "Firewall" im Nav (DE).
* Dashboard-i18n Block in DE+EN.
* Version 1.0.11 → 1.0.12.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

management-ui/src/i18n/locales/de/common.json

@@ -179,6 +179,7 @@
   },
   "domains": {
     "title": "Domains",
+    "intro": "Verwalte FQDNs, die HAProxy terminiert. Optionales Primary-Backend als Catch-all; Pfad-Routing via Routing-Regeln.",
     "addDomain": "Domain hinzufügen",
     "editDomain": "Domain bearbeiten",
     "name": "Name",
@@ -197,6 +198,7 @@
   },
   "backends": {
     "title": "Backends",
+    "intro": "Upstream-Server, an die HAProxy weiterroutet. Health-Check-Pfad optional aktiviert TCP+HTTP-Probes alle 5s.",
     "addBackend": "Backend hinzufügen",
     "editBackend": "Backend bearbeiten",
     "name": "Name",
@@ -216,6 +218,7 @@
   },
   "routing": {
     "title": "Routing-Regeln",
+    "intro": "Pfad-Präfix → Backend-Mapping pro Domain. Niedrige Priority gewinnt; Catch-all per Domain.primary_backend.",
     "addRule": "Regel hinzufügen",
     "editRule": "Regel bearbeiten",
     "domain": "Domain",
@@ -342,7 +345,54 @@
       "pskOff": "kein PSK",
       "downloadConf": "wg-quick.conf herunterladen",
       "qrTitle": "WireGuard-QR",
-      "qrHint": "Mit der WireGuard-App (iOS/Android) scannen: \"Tunnel hinzufügen\" → \"QR-Code scannen\". Endpoint im Download-Conf bitte vor Verwendung anpassen."
+      "qrHint": "Mit der WireGuard-App (iOS/Android) scannen: \"Tunnel hinzufügen\" → \"QR-Code scannen\". Endpoint im Download-Conf bitte vor Verwendung anpassen.",
+      "online": "Online",
+      "offline": "Offline",
+      "traffic": "Traffic"
+    }
+  },
+  "dashboard": {
+    "title": "Dashboard",
+    "welcomeHint": "EdgeGuard-Übersicht — Health, Counts, Live-Status der wichtigsten Dienste.",
+    "kpi": {
+      "domains": "Domains",
+      "backends": "Backends",
+      "ifaces": "Interfaces",
+      "fwRules": "FW-Regeln",
+      "natRules": "NAT-Regeln",
+      "wg": "WG-Verbindungen"
+    },
+    "wgCard": {
+      "title": "WireGuard",
+      "empty": "Noch kein WG-Tunnel angelegt."
+    },
+    "firewallCard": {
+      "title": "Firewall",
+      "zones": "Zonen",
+      "activeRules": "{{rules}} aktive Regeln · {{nat}} NAT"
+    },
+    "sslCard": {
+      "title": "SSL-Zertifikate",
+      "total": "Verwaltete Zertifikate",
+      "expiringSoon": "{{count}} läuft bald ab (< 30 Tage)",
+      "allFresh": "Alle Zertifikate haben > 30 Tage Restlaufzeit."
+    },
+    "clusterCard": {
+      "title": "Cluster",
+      "nodes": "Knoten"
+    },
+    "routingCard": {
+      "title": "Routing",
+      "domains": "Domains",
+      "backends": "Backends",
+      "attached": "{{count}}/{{total}} Domains haben einen Primary-Backend"
+    },
+    "systemCard": {
+      "title": "System",
+      "version": "Version",
+      "api": "API",
+      "ifaces": "Interfaces",
+      "wg": "WireGuard"
     }
   },
   "common": {

management-ui/src/i18n/locales/en/common.json

@@ -179,6 +179,7 @@
   },
   "domains": {
     "title": "Domains",
+    "intro": "Manage FQDNs that HAProxy terminates. Optional primary backend as catch-all; path-based routing via routing rules.",
     "addDomain": "Add domain",
     "editDomain": "Edit domain",
     "name": "Name",
@@ -197,6 +198,7 @@
   },
   "backends": {
     "title": "Backends",
+    "intro": "Upstream servers HAProxy proxies to. Optional health-check path enables TCP + HTTP probes every 5s.",
     "addBackend": "Add backend",
     "editBackend": "Edit backend",
     "name": "Name",
@@ -216,6 +218,7 @@
   },
   "routing": {
     "title": "Routing rules",
+    "intro": "Path-prefix → backend mapping per domain. Lowest priority wins; catch-all via domain.primary_backend.",
     "addRule": "Add rule",
     "editRule": "Edit rule",
     "domain": "Domain",
@@ -342,7 +345,54 @@
       "pskOff": "no PSK",
       "downloadConf": "Download wg-quick.conf",
       "qrTitle": "WireGuard QR",
-      "qrHint": "Scan with the WireGuard app (iOS/Android): \"Add tunnel\" → \"Scan QR code\". Replace the Endpoint placeholder in the downloaded conf before use."
+      "qrHint": "Scan with the WireGuard app (iOS/Android): \"Add tunnel\" → \"Scan QR code\". Replace the Endpoint placeholder in the downloaded conf before use.",
+      "online": "Online",
+      "offline": "Offline",
+      "traffic": "Traffic"
+    }
+  },
+  "dashboard": {
+    "title": "Dashboard",
+    "welcomeHint": "EdgeGuard overview — health, counts, live status of the major services.",
+    "kpi": {
+      "domains": "Domains",
+      "backends": "Backends",
+      "ifaces": "Interfaces",
+      "fwRules": "FW rules",
+      "natRules": "NAT rules",
+      "wg": "WG connections"
+    },
+    "wgCard": {
+      "title": "WireGuard",
+      "empty": "No WG tunnel configured yet."
+    },
+    "firewallCard": {
+      "title": "Firewall",
+      "zones": "Zones",
+      "activeRules": "{{rules}} active rules · {{nat}} NAT"
+    },
+    "sslCard": {
+      "title": "SSL certificates",
+      "total": "Managed certificates",
+      "expiringSoon": "{{count}} expiring soon (< 30 days)",
+      "allFresh": "All certs have > 30 days remaining."
+    },
+    "clusterCard": {
+      "title": "Cluster",
+      "nodes": "Nodes"
+    },
+    "routingCard": {
+      "title": "Routing",
+      "domains": "Domains",
+      "backends": "Backends",
+      "attached": "{{count}}/{{total}} domains have a primary backend"
+    },
+    "systemCard": {
+      "title": "System",
+      "version": "Version",
+      "api": "API",
+      "ifaces": "Interfaces",
+      "wg": "WireGuard"
     }
   },
   "common": {