Refactor architecture: extract reconciler, add interfaces, reduce complexity, improve test coverage

Architecture:
- Extract reconcileNetworking into internal/reconcile package with 7 consumer-side interfaces
- Add locked modifyState helper to fix state.yaml read-modify-write race condition
- Extract CrowdSec and VPN handler groups with interfaces documenting dependency surface
- Replace raw map[string]any YAML manipulation with typed AddDHCPStaticLease/RemoveDHCPStaticLease
- Extract Cloudflare API functions into cfClient struct, eliminating repeated auth boilerplate

Complexity reduction:
- haproxy.GenerateWithOpts: 50 → 6 (extracted 8 focused helpers)
- reconcile.Reconcile: 42 → 11 (extracted buildRoutes, buildDNSEntries, writeHAProxyConfig)
- AutheliaUpdateConfig: 25 → 10 (extracted enableAuthelia/disableAuthelia)

Test coverage improvements:
- reconcile: 4.5% → 56.8% (stub-based tests for route building, DNS entries, orchestration)
- dnsfilter: 10.7% → 45.6% (Manager.Compile, AddList, ToggleList, custom entries)
- config: 67.3% → 89.8% (DHCP static lease mutation tests)

internal/config/config.go

@@ -116,8 +116,8 @@ type State struct {
 		} `yaml:"ddns,omitempty" json:"ddns,omitempty"`
 		Authelia struct {
 			Enabled       bool   `yaml:"enabled,omitempty" json:"enabled,omitempty"`
-			Domain        string `yaml:"domain,omitempty" json:"domain,omitempty"`                 // login portal domain (e.g. auth.payne.io)
-			DefaultPolicy string `yaml:"defaultPolicy,omitempty" json:"defaultPolicy,omitempty"`   // one_factor or two_factor
+			Domain        string `yaml:"domain,omitempty" json:"domain,omitempty"`               // login portal domain (e.g. auth.payne.io)
+			DefaultPolicy string `yaml:"defaultPolicy,omitempty" json:"defaultPolicy,omitempty"` // one_factor or two_factor
 			SMTP          struct {
 				Host     string `yaml:"host,omitempty" json:"host,omitempty"`         // e.g. smtp.gmail.com
 				Port     int    `yaml:"port,omitempty" json:"port,omitempty"`         // e.g. 587
@@ -132,6 +132,29 @@ type State struct {
 	} `yaml:"cloud,omitempty" json:"cloud,omitempty"`
 }
 
+// AddDHCPStaticLease adds or replaces a static lease entry (matched by MAC).
+func (s *State) AddDHCPStaticLease(lease DHCPStaticLease) {
+	for i, l := range s.Cloud.Dnsmasq.DHCP.StaticLeases {
+		if l.MAC == lease.MAC {
+			s.Cloud.Dnsmasq.DHCP.StaticLeases[i] = lease
+			return
+		}
+	}
+	s.Cloud.Dnsmasq.DHCP.StaticLeases = append(s.Cloud.Dnsmasq.DHCP.StaticLeases, lease)
+}
+
+// RemoveDHCPStaticLease removes a static lease entry by MAC. Returns true if found.
+func (s *State) RemoveDHCPStaticLease(mac string) bool {
+	leases := s.Cloud.Dnsmasq.DHCP.StaticLeases
+	for i, l := range leases {
+		if l.MAC == mac {
+			s.Cloud.Dnsmasq.DHCP.StaticLeases = append(leases[:i], leases[i+1:]...)
+			return true
+		}
+	}
+	return false
+}
+
 // LoadState loads state from the specified path
 func LoadState(configPath string) (*State, error) {
 	data, err := os.ReadFile(configPath)
@@ -161,5 +184,3 @@ func SaveState(config *State, configPath string) error {
 
 	return os.WriteFile(configPath, data, 0644)
 }
-
-

internal/config/config_test.go

@@ -266,3 +266,53 @@ func TestState_RoundTrip(t *testing.T) {
 	}
 }
 
+func TestAddDHCPStaticLease_New(t *testing.T) {
+	s := &State{}
+	s.AddDHCPStaticLease(DHCPStaticLease{MAC: "aa:bb:cc:dd:ee:ff", IP: "192.168.1.100", Hostname: "host1"})
+
+	if len(s.Cloud.Dnsmasq.DHCP.StaticLeases) != 1 {
+		t.Fatalf("expected 1 lease, got %d", len(s.Cloud.Dnsmasq.DHCP.StaticLeases))
+	}
+	l := s.Cloud.Dnsmasq.DHCP.StaticLeases[0]
+	if l.MAC != "aa:bb:cc:dd:ee:ff" || l.IP != "192.168.1.100" || l.Hostname != "host1" {
+		t.Errorf("lease mismatch: %+v", l)
+	}
+}
+
+func TestAddDHCPStaticLease_ReplaceByMAC(t *testing.T) {
+	s := &State{}
+	s.AddDHCPStaticLease(DHCPStaticLease{MAC: "aa:bb:cc:dd:ee:ff", IP: "192.168.1.100"})
+	s.AddDHCPStaticLease(DHCPStaticLease{MAC: "aa:bb:cc:dd:ee:ff", IP: "192.168.1.200"})
+
+	if len(s.Cloud.Dnsmasq.DHCP.StaticLeases) != 1 {
+		t.Fatalf("expected 1 lease after replace, got %d", len(s.Cloud.Dnsmasq.DHCP.StaticLeases))
+	}
+	if s.Cloud.Dnsmasq.DHCP.StaticLeases[0].IP != "192.168.1.200" {
+		t.Errorf("expected IP to be updated to 192.168.1.200, got %s", s.Cloud.Dnsmasq.DHCP.StaticLeases[0].IP)
+	}
+}
+
+func TestRemoveDHCPStaticLease_Exists(t *testing.T) {
+	s := &State{}
+	s.AddDHCPStaticLease(DHCPStaticLease{MAC: "aa:bb:cc:dd:ee:ff", IP: "192.168.1.100"})
+	s.AddDHCPStaticLease(DHCPStaticLease{MAC: "11:22:33:44:55:66", IP: "192.168.1.101"})
+
+	found := s.RemoveDHCPStaticLease("aa:bb:cc:dd:ee:ff")
+	if !found {
+		t.Error("expected RemoveDHCPStaticLease to return true")
+	}
+	if len(s.Cloud.Dnsmasq.DHCP.StaticLeases) != 1 {
+		t.Fatalf("expected 1 lease remaining, got %d", len(s.Cloud.Dnsmasq.DHCP.StaticLeases))
+	}
+	if s.Cloud.Dnsmasq.DHCP.StaticLeases[0].MAC != "11:22:33:44:55:66" {
+		t.Error("wrong lease was removed")
+	}
+}
+
+func TestRemoveDHCPStaticLease_NotFound(t *testing.T) {
+	s := &State{}
+	found := s.RemoveDHCPStaticLease("nonexistent")
+	if found {
+		t.Error("expected RemoveDHCPStaticLease to return false for missing MAC")
+	}
+}

internal/config/extraports_test.go

@@ -100,7 +100,7 @@ func TestExtraPortsYAML_StructuredRoundTrip(t *testing.T) {
 func TestSplitExtraPorts(t *testing.T) {
 	ports := []ExtraPort{
 		{Port: 22, Protocol: "tcp"},
-		{Port: 80},              // default = tcp
+		{Port: 80}, // default = tcp
 		{Port: 5353, Protocol: "udp"},
 		{Port: 123, Protocol: "UDP"}, // case-insensitive
 	}