WireGuard access classes, firewall nftables fixes, network sync event refactor

- WireGuard: refactor to multi-interface 'access classes' model; extract config
  generation and helpers into lib/wireguard.py; add per-class up/down endpoints
  and API routes; update UI with class management pages and QR code component
- Firewall: fix zone creation with --new-zone before --set-target; skip
  masquerade on public zone; add masquerade propagation for nftables backend
  so NAT works when internal zones exit via public
- Network: rename sync event subsystem 'network' -> 'networkd'; always stamp
  config hash even when deployment fails (fixes pending-changes detection)
- DHCP: add new API endpoint and update frontend page
- State/Sync: update state collectors and sync buses for new subsystems
- Docs: update API and config documentation for new endpoints and schemas

tests/test_system_import.py

@@ -580,9 +580,13 @@ class TestImportFirewall:
 
 
 class TestImportAll:
-    def test_all_missing(self, temp_project):
-        result = system_import.import_all()
-        assert result == []
+    def test_all_missing(self, temp_project, tmp_path):
+        from unittest.mock import MagicMock, patch
+
+        mock_run = MagicMock(side_effect=RuntimeError("command not found"))
+        with patch.object(system_import, "run", mock_run):
+            result = system_import.import_all()
+            assert result == []
 
     def test_returns_updated_subsystems(self, temp_project, tmp_path):
         # Create dnsmasq conf