Refactor architecture: extract reconciler, add interfaces, reduce complexity, improve test coverage

Architecture:
- Extract reconcileNetworking into internal/reconcile package with 7 consumer-side interfaces
- Add locked modifyState helper to fix state.yaml read-modify-write race condition
- Extract CrowdSec and VPN handler groups with interfaces documenting dependency surface
- Replace raw map[string]any YAML manipulation with typed AddDHCPStaticLease/RemoveDHCPStaticLease
- Extract Cloudflare API functions into cfClient struct, eliminating repeated auth boilerplate

Complexity reduction:
- haproxy.GenerateWithOpts: 50 → 6 (extracted 8 focused helpers)
- reconcile.Reconcile: 42 → 11 (extracted buildRoutes, buildDNSEntries, writeHAProxyConfig)
- AutheliaUpdateConfig: 25 → 10 (extracted enableAuthelia/disableAuthelia)

Test coverage improvements:
- reconcile: 4.5% → 56.8% (stub-based tests for route building, DNS entries, orchestration)
- dnsfilter: 10.7% → 45.6% (Manager.Compile, AddList, ToggleList, custom entries)
- config: 67.3% → 89.8% (DHCP static lease mutation tests)

internal/api/v1/handlers_certbot.go

@@ -148,7 +148,7 @@ func (api *API) CertProvision(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Trigger reconciliation so HAProxy picks up the new cert
-	go api.reconcileNetworking()
+	go api.reconciler.Reconcile()
 
 	status := api.certbot.GetStatus(domain)
 	respondJSON(w, http.StatusOK, map[string]any{
@@ -171,7 +171,7 @@ func (api *API) CertRenew(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Trigger reconciliation
-	go api.reconcileNetworking()
+	go api.reconciler.Reconcile()
 
 	respondJSON(w, http.StatusOK, map[string]string{"message": "Certificates renewed"})
 }
@@ -184,4 +184,3 @@ func (api *API) getCentralDomain() string {
 	}
 	return globalCfg.Cloud.Central.Domain
 }
-