dhcp: auto-populate gateway from interface IP for DHCP ranges

Add get_interface_ip() helper to resolve an interface's IPv4 address
via 'ip -o addr show'.  Use it to back-propagate gateway into DHCP
ranges so clients receive their default route.

- set_dhcp_range() resolves gateway: explicit > existing range > iface IP
- DnsToFirewallSync and FirewallToDhcpSync sync ensure gateways are set
- Remove automatic masquerade toggle from DnsToFirewallSync
- Fix dnsmasq lease file path to /var/lib/misc/dnsmasq.leases
- Rename lease state field expires_at -> expires (ISO string)
- Add 'ip -o addr show' to sudo whitelist

lib/common.py

@@ -169,11 +169,31 @@ def ensure_dirs(*dirs: Path) -> None:
         d.mkdir(parents=True, exist_ok=True)
 
 
+def get_interface_ip(iface: str) -> str | None:
+    """Return the primary IPv4 address of *iface* (without CIDR), or ``None``.
+
+    Uses ``ip -o addr show`` which is in the daemon sudo whitelist.
+    """
+    if not iface:
+        return None
+    try:
+        raw = run(["ip", "-o", "addr", "show", iface], sudo=True)
+        for line in raw.splitlines():
+            parts = line.split()
+            # -o format: "NUM: IFACE   inet/6 ADDR/MASK ..."
+            if len(parts) >= 4 and parts[2] == "inet":
+                return parts[3].split("/", 1)[0]
+    except Exception:
+        pass
+    return None
+
+
 __all__ = [
     "_APPLY_HASH_KEY",
     "config_hash",
     "deep_merge",
     "ensure_dirs",
+    "get_interface_ip",
     "load_json",
     "run",
     "run_proc",