dhcp: auto-populate gateway from interface IP for DHCP ranges

Add get_interface_ip() helper to resolve an interface's IPv4 address
via 'ip -o addr show'.  Use it to back-propagate gateway into DHCP
ranges so clients receive their default route.

- set_dhcp_range() resolves gateway: explicit > existing range > iface IP
- DnsToFirewallSync and FirewallToDhcpSync sync ensure gateways are set
- Remove automatic masquerade toggle from DnsToFirewallSync
- Fix dnsmasq lease file path to /var/lib/misc/dnsmasq.leases
- Rename lease state field expires_at -> expires (ISO string)
- Add 'ip -o addr show' to sudo whitelist

tests/test_sync.py

@@ -229,7 +229,7 @@ class TestDnsToFirewallSync:
     @patch("lib.firewall.save_config")
     @patch("lib.firewall.get_config")
     @patch("lib.dnsmasq.get_config")
-    def test_adds_dhcp_dns_masquerade(self, mock_dm_get, mock_fw_get, mock_fw_save):
+    def test_adds_dhcp_dns(self, mock_dm_get, mock_fw_get, mock_fw_save):
         mock_dm_get.return_value = {
             "dhcp": {
                 "ranges": [
@@ -262,7 +262,6 @@ class TestDnsToFirewallSync:
         saved_cfg = mock_fw_save.call_args[0][0]
         assert "dhcp" in saved_cfg["zones"]["internal"]["services"]
         assert "dns" in saved_cfg["zones"]["internal"]["services"]
-        assert saved_cfg["zones"]["internal"]["masquerade"] is True
 
     @patch("lib.firewall.save_config")
     @patch("lib.firewall.get_config")
@@ -288,7 +287,6 @@ class TestDnsToFirewallSync:
         saved_cfg = mock_fw_save.call_args[0][0]
         assert "dhcp" not in saved_cfg["zones"]["internal"]["services"]
         assert "dns" not in saved_cfg["zones"]["internal"]["services"]
-        assert saved_cfg["zones"]["internal"]["masquerade"] is False
 
     @patch("lib.firewall.save_config")
     @patch("lib.firewall.get_config")