WireGuard access classes, firewall nftables fixes, network sync event refactor

- WireGuard: refactor to multi-interface 'access classes' model; extract config
  generation and helpers into lib/wireguard.py; add per-class up/down endpoints
  and API routes; update UI with class management pages and QR code component
- Firewall: fix zone creation with --new-zone before --set-target; skip
  masquerade on public zone; add masquerade propagation for nftables backend
  so NAT works when internal zones exit via public
- Network: rename sync event subsystem 'network' -> 'networkd'; always stamp
  config hash even when deployment fails (fixes pending-changes detection)
- DHCP: add new API endpoint and update frontend page
- State/Sync: update state collectors and sync buses for new subsystems
- Docs: update API and config documentation for new endpoints and schemas

daemon/iface.py

@@ -99,6 +99,20 @@ DELETE_WIREGUARD_PEERS_REMOVE: Endpoint = _ep("DELETE", "/wireguard/peers/remove
 GET_WIREGUARD_PEERS: Endpoint = _ep("GET", "/wireguard/peers")
 GET_WIREGUARD_PEER_STATUS: Endpoint = _ep("GET", "/wireguard/peer-status")
 POST_WIREGUARD_GENERATE_CLIENT: Endpoint = _ep("POST", "/wireguard/generate-client")
+GET_WIREGUARD_CLASSES: Endpoint = _ep("GET", "/wireguard/classes")
+POST_WIREGUARD_CLASSES: Endpoint = _ep("POST", "/wireguard/classes")
+PATCH_WIREGUARD_CLASSES: Endpoint = _ep("PATCH", "/wireguard/classes/<key>")
+DELETE_WIREGUARD_CLASSES: Endpoint = _ep("DELETE", "/wireguard/classes/<key>")
+POST_WIREGUARD_CLASSES_UP: Endpoint = _ep("POST", "/wireguard/classes/<class_key>/up")
+DELETE_WIREGUARD_CLASSES_DOWN: Endpoint = _ep(
+    "DELETE", "/wireguard/classes/<class_key>/down"
+)
+GET_WIREGUARD_CLASS_STATUS: Endpoint = _ep(
+    "GET", "/wireguard/classes/<class_key>/status"
+)
+POST_WIREGUARD_CLASS_INIT_KEYS: Endpoint = _ep(
+    "POST", "/wireguard/classes/keys/<class_key>"
+)
 
 # ---- ACME / Certs ----
 GET_ACME_LIST: Endpoint = _ep("GET", "/acme/list")