Refactor architecture: extract reconciler, add interfaces, reduce complexity, improve test coverage

Architecture:
- Extract reconcileNetworking into internal/reconcile package with 7 consumer-side interfaces
- Add locked modifyState helper to fix state.yaml read-modify-write race condition
- Extract CrowdSec and VPN handler groups with interfaces documenting dependency surface
- Replace raw map[string]any YAML manipulation with typed AddDHCPStaticLease/RemoveDHCPStaticLease
- Extract Cloudflare API functions into cfClient struct, eliminating repeated auth boilerplate

Complexity reduction:
- haproxy.GenerateWithOpts: 50 → 6 (extracted 8 focused helpers)
- reconcile.Reconcile: 42 → 11 (extracted buildRoutes, buildDNSEntries, writeHAProxyConfig)
- AutheliaUpdateConfig: 25 → 10 (extracted enableAuthelia/disableAuthelia)

Test coverage improvements:
- reconcile: 4.5% → 56.8% (stub-based tests for route building, DNS entries, orchestration)
- dnsfilter: 10.7% → 45.6% (Manager.Compile, AddList, ToggleList, custom entries)
- config: 67.3% → 89.8% (DHCP static lease mutation tests)

internal/authelia/oidc.go

@@ -11,13 +11,13 @@ import (
 
 // OIDCClient represents a registered OIDC client application
 type OIDCClient struct {
-	ID          string   `yaml:"client_id" json:"clientId"`
-	Name        string   `yaml:"client_name" json:"clientName"`
-	Secret      string   `yaml:"client_secret" json:"clientSecret,omitempty"` // pbkdf2 hash in config, cleartext on create response
+	ID           string   `yaml:"client_id" json:"clientId"`
+	Name         string   `yaml:"client_name" json:"clientName"`
+	Secret       string   `yaml:"client_secret" json:"clientSecret,omitempty"` // pbkdf2 hash in config, cleartext on create response
 	RedirectURIs []string `yaml:"redirect_uris" json:"redirectUris"`
-	Scopes      []string `yaml:"scopes" json:"scopes"`
-	Policy      string   `yaml:"authorization_policy" json:"authorizationPolicy"`
-	ConsentMode string   `yaml:"consent_mode,omitempty" json:"consentMode,omitempty"`
+	Scopes       []string `yaml:"scopes" json:"scopes"`
+	Policy       string   `yaml:"authorization_policy" json:"authorizationPolicy"`
+	ConsentMode  string   `yaml:"consent_mode,omitempty" json:"consentMode,omitempty"`
 }
 
 // OIDCClientUpdate holds partial updates for an OIDC client