Refactor architecture: extract reconciler, add interfaces, reduce complexity, improve test coverage

Architecture:
- Extract reconcileNetworking into internal/reconcile package with 7 consumer-side interfaces
- Add locked modifyState helper to fix state.yaml read-modify-write race condition
- Extract CrowdSec and VPN handler groups with interfaces documenting dependency surface
- Replace raw map[string]any YAML manipulation with typed AddDHCPStaticLease/RemoveDHCPStaticLease
- Extract Cloudflare API functions into cfClient struct, eliminating repeated auth boilerplate

Complexity reduction:
- haproxy.GenerateWithOpts: 50 → 6 (extracted 8 focused helpers)
- reconcile.Reconcile: 42 → 11 (extracted buildRoutes, buildDNSEntries, writeHAProxyConfig)
- AutheliaUpdateConfig: 25 → 10 (extracted enableAuthelia/disableAuthelia)

Test coverage improvements:
- reconcile: 4.5% → 56.8% (stub-based tests for route building, DNS entries, orchestration)
- dnsfilter: 10.7% → 45.6% (Manager.Compile, AddList, ToggleList, custom entries)
- config: 67.3% → 89.8% (DHCP static lease mutation tests)

internal/dnsmasq/config.go

@@ -26,7 +26,7 @@ type DNSEntry struct {
 
 // ConfigGenerator handles dnsmasq configuration generation
 type ConfigGenerator struct {
-	configPath    string
+	configPath     string
 	filterConfPath string // path to addn-hosts file for DNS filtering
 }
 
@@ -135,12 +135,12 @@ func (g *ConfigGenerator) RestartService() error {
 
 // ServiceStatus represents the status of the dnsmasq service
 type ServiceStatus struct {
-	Status              string    `json:"status"`
-	PID                 int       `json:"pid"`
-	IP                  string    `json:"ip"`
-	ConfigFile          string    `json:"config_file"`
-	DomainsConfigured   int       `json:"domains_configured"`
-	LastRestart         time.Time `json:"last_restart"`
+	Status            string    `json:"status"`
+	PID               int       `json:"pid"`
+	IP                string    `json:"ip"`
+	ConfigFile        string    `json:"config_file"`
+	DomainsConfigured int       `json:"domains_configured"`
+	LastRestart       time.Time `json:"last_restart"`
 }
 
 // GetStatus checks the status of the dnsmasq service