Refactor architecture: extract reconciler, add interfaces, reduce complexity, improve test coverage

Architecture:
- Extract reconcileNetworking into internal/reconcile package with 7 consumer-side interfaces
- Add locked modifyState helper to fix state.yaml read-modify-write race condition
- Extract CrowdSec and VPN handler groups with interfaces documenting dependency surface
- Replace raw map[string]any YAML manipulation with typed AddDHCPStaticLease/RemoveDHCPStaticLease
- Extract Cloudflare API functions into cfClient struct, eliminating repeated auth boilerplate

Complexity reduction:
- haproxy.GenerateWithOpts: 50 → 6 (extracted 8 focused helpers)
- reconcile.Reconcile: 42 → 11 (extracted buildRoutes, buildDNSEntries, writeHAProxyConfig)
- AutheliaUpdateConfig: 25 → 10 (extracted enableAuthelia/disableAuthelia)

Test coverage improvements:
- reconcile: 4.5% → 56.8% (stub-based tests for route building, DNS entries, orchestration)
- dnsfilter: 10.7% → 45.6% (Manager.Compile, AddList, ToggleList, custom entries)
- config: 67.3% → 89.8% (DHCP static lease mutation tests)

internal/authelia/config.go

@@ -15,10 +15,10 @@ import (
 
 // ConfigOpts holds parameters for generating Authelia's configuration.yml
 type ConfigOpts struct {
-	Domain        string       // auth portal domain (e.g. auth.payne.io)
-	JWTSecret     string       // identity validation JWT secret
-	SessionSecret string       // session cookie secret
-	StorageEncKey string       // storage encryption key (>=20 chars)
+	Domain         string       // auth portal domain (e.g. auth.payne.io)
+	JWTSecret      string       // identity validation JWT secret
+	SessionSecret  string       // session cookie secret
+	StorageEncKey  string       // storage encryption key (>=20 chars)
 	OIDCHMACSecret string       // OIDC HMAC secret
 	DefaultPolicy  string       // "one_factor" or "two_factor"
 	SessionDomain  string       // cookie domain for SSO (e.g. payne.io) — forward-auth only works for subdomains of this
@@ -116,11 +116,11 @@ func (m *Manager) buildConfig(opts ConfigOpts) map[string]any {
 			"file": map[string]any{
 				"path": m.usersDBPath(),
 				"password": map[string]any{
-					"algorithm":  "argon2id",
-					"iterations": 3,
-					"memory":     65536,
+					"algorithm":   "argon2id",
+					"iterations":  3,
+					"memory":      65536,
 					"parallelism": 2,
-					"key_length": 32,
+					"key_length":  32,
 					"salt_length": 16,
 				},
 			},
@@ -185,7 +185,7 @@ func (m *Manager) buildConfig(opts ConfigOpts) map[string]any {
 					"client_secret":        c.Secret, // already hashed
 					"redirect_uris":        c.RedirectURIs,
 					"scopes":               c.Scopes,
-					"authorization_policy":  c.Policy,
+					"authorization_policy": c.Policy,
 				}
 				if c.ConsentMode != "" {
 					client["consent_mode"] = c.ConsentMode