WireGuard access classes, firewall nftables fixes, network sync event refactor

- WireGuard: refactor to multi-interface 'access classes' model; extract config
  generation and helpers into lib/wireguard.py; add per-class up/down endpoints
  and API routes; update UI with class management pages and QR code component
- Firewall: fix zone creation with --new-zone before --set-target; skip
  masquerade on public zone; add masquerade propagation for nftables backend
  so NAT works when internal zones exit via public
- Network: rename sync event subsystem 'network' -> 'networkd'; always stamp
  config hash even when deployment fails (fixes pending-changes detection)
- DHCP: add new API endpoint and update frontend page
- State/Sync: update state collectors and sync buses for new subsystems
- Docs: update API and config documentation for new endpoints and schemas

daemon/handlers/firewall.py

@@ -136,16 +136,22 @@ def _config_apply() -> dict[str, Any]:
         need_create = zone_name not in available
 
         if need_create:
-            target = _normalize_target(zone_cfg.get("target", "DEFAULT"))
+            # Create new zone first (--new-zone is required before --set-target)
             run(
-                [
-                    "firewall-cmd",
-                    f"--zone={zone_name}",
-                    f"--set-target={target}",
-                    "--permanent",
-                ],
+                ["firewall-cmd", f"--new-zone={zone_name}", "--permanent"],
                 sudo=True,
             )
+            target = _normalize_target(zone_cfg.get("target", "DEFAULT"))
+            if target != "default":
+                run(
+                    [
+                        "firewall-cmd",
+                        f"--zone={zone_name}",
+                        f"--set-target={target}",
+                        "--permanent",
+                    ],
+                    sudo=True,
+                )
             _reload()
         else:
             desired_target = _normalize_target(zone_cfg.get("target", "DEFAULT"))
@@ -223,13 +229,15 @@ def _config_apply() -> dict[str, Any]:
             )
 
         # Step 4: Toggle masquerade if explicitly set (None means "don't change").
-        mq = zone_cfg.get("masquerade", False)
-        if mq is not None:
-            action = "--add-masquerade" if mq else "--remove-masquerade"
-            run(
-                ["firewall-cmd", f"--zone={zone_name}", action, "--permanent"],
-                sudo=True,
-            )
+        # Skip 'public' — Step 7 handles masquerade propagation for nftables.
+        if zone_name != "public":
+            mq = zone_cfg.get("masquerade", False)
+            if mq is not None:
+                action = "--add-masquerade" if mq else "--remove-masquerade"
+                run(
+                    ["firewall-cmd", f"--zone={zone_name}", action, "--permanent"],
+                    sudo=True,
+                )
 
         # Step 5: Reconcile rich rules — remove all current, add desired.
         # Note: firewall-cmd doesn't track rule IDs for rich rules, so we
@@ -296,6 +304,33 @@ def _config_apply() -> dict[str, Any]:
 
         applied.append(zone_name)
 
+    # Step 7: Ensure masquerade propagation for nftables backend.
+    # With firewalld's nftables backend, POSTROUTING policy chains route traffic
+    # to the OUTPUT interface's zone chain. Traffic from internal zones (eth1)
+    # exiting through public (eth0) hits public's POSTROUTING chain, not
+    # internal's. If any non-public zone has masquerade enabled but the public
+    # zone doesn't, NAT silently fails — so propagate masquerade to public.
+    _any_non_public_mq = any(
+        z.get("masquerade", False) for zn, z in cfg_zones.items() if zn != "public"
+    )
+    _public_mq = cfg_zones.get("public", {}).get("masquerade", False)
+    if _any_non_public_mq and not _public_mq:
+        logger.info("Propagating masquerade to public zone for nftables compatibility")
+        run(
+            ["firewall-cmd", "--zone=public", "--add-masquerade", "--permanent"],
+            sudo=True,
+        )
+        cfg.setdefault("zones", {}).setdefault("public", {})["masquerade"] = True
+        _save_config(cfg)
+    elif not _any_non_public_mq and _public_mq:
+        logger.info("No non-public zone needs masquerade, removing from public zone")
+        run(
+            ["firewall-cmd", "--zone=public", "--remove-masquerade", "--permanent"],
+            sudo=True,
+        )
+        cfg.setdefault("zones", {}).setdefault("public", {})["masquerade"] = False
+        _save_config(cfg)
+
     _reload()
     full_state = {
         "active_zones": {},