WireGuard access classes, firewall nftables fixes, network sync event refactor

- WireGuard: refactor to multi-interface 'access classes' model; extract config
  generation and helpers into lib/wireguard.py; add per-class up/down endpoints
  and API routes; update UI with class management pages and QR code component
- Firewall: fix zone creation with --new-zone before --set-target; skip
  masquerade on public zone; add masquerade propagation for nftables backend
  so NAT works when internal zones exit via public
- Network: rename sync event subsystem 'network' -> 'networkd'; always stamp
  config hash even when deployment fails (fixes pending-changes detection)
- DHCP: add new API endpoint and update frontend page
- State/Sync: update state collectors and sync buses for new subsystems
- Docs: update API and config documentation for new endpoints and schemas

docs/api.md

@@ -1320,6 +1320,86 @@ This is the only endpoint that returns a WireGuard private key. All other endpoi
 
 Returns HTTP `404` if the peer is not found.
 
+### Access Classes
+
+Manage VPN access classes that categorize peers by access level (e.g., full LAN access, internet-only).
+
+#### List Access Classes
+
+```
+GET /api/wireguard/classes
+```
+
+Return all configured access classes.
+
+**Response (`data`):**
+
+Object keyed by class identifier, each with `name` and `description` fields.
+
+#### Create Access Class
+
+```
+POST /api/wireguard/classes
+```
+
+Create a new access class.
+
+**Request Body:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `key` | `string` | Yes | Class identifier (alphanumeric) |
+| `name` | `string` | No | Display name (defaults to key) |
+| `description` | `string` | No | Description text |
+
+**Response (`data`):**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `key` | `string` | Class key |
+| `name` | `string` | Display name |
+| `description` | `string` | Description |
+
+Returns HTTP `409` if the key already exists.
+
+#### Update Access Class
+
+```
+PATCH /api/wireguard/classes
+```
+
+Update an existing access class.
+
+**Request Body:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `key` | `string` | Yes | Class identifier |
+| `name` | `string` | No | New display name |
+| `description` | `string` | No | New description |
+
+**Response (`data`):** Updated class object with `key`, `name`, `description`.
+
+Returns HTTP `404` if the class is not found.
+
+#### Delete Access Class
+
+```
+DELETE /api/wireguard/classes
+```
+
+Remove an access class. Cannot delete a class that has peers assigned to it.
+
+**Request Body:**
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `key` | `string` | Yes | Class identifier |
+
+**Response (`data`):** `{ "key": "<key>" }`
+
+Returns HTTP `404` if the class is not found. Returns HTTP `409` if peers reference the class.
+
 ---
 
 ## Network API