Refactor architecture: extract reconciler, add interfaces, reduce complexity, improve test coverage

Architecture:
- Extract reconcileNetworking into internal/reconcile package with 7 consumer-side interfaces
- Add locked modifyState helper to fix state.yaml read-modify-write race condition
- Extract CrowdSec and VPN handler groups with interfaces documenting dependency surface
- Replace raw map[string]any YAML manipulation with typed AddDHCPStaticLease/RemoveDHCPStaticLease
- Extract Cloudflare API functions into cfClient struct, eliminating repeated auth boilerplate

Complexity reduction:
- haproxy.GenerateWithOpts: 50 → 6 (extracted 8 focused helpers)
- reconcile.Reconcile: 42 → 11 (extracted buildRoutes, buildDNSEntries, writeHAProxyConfig)
- AutheliaUpdateConfig: 25 → 10 (extracted enableAuthelia/disableAuthelia)

Test coverage improvements:
- reconcile: 4.5% → 56.8% (stub-based tests for route building, DNS entries, orchestration)
- dnsfilter: 10.7% → 45.6% (Manager.Compile, AddList, ToggleList, custom entries)
- config: 67.3% → 89.8% (DHCP static lease mutation tests)

internal/tunnel/manager.go

@@ -23,10 +23,10 @@ import (
 
 // Config holds tunnel configuration.
 type Config struct {
-	Enabled       bool   `yaml:"enabled" json:"enabled"`
-	TunnelID      string `yaml:"tunnelId" json:"tunnelId"`
-	PublicDomain  string `yaml:"publicDomain" json:"publicDomain"`   // e.g. "pub.payne.io"
-	GatewayDomain string `yaml:"gatewayDomain" json:"gatewayDomain"` // e.g. "payne.io" (internal)
+	Enabled        bool   `yaml:"enabled" json:"enabled"`
+	TunnelID       string `yaml:"tunnelId" json:"tunnelId"`
+	PublicDomain   string `yaml:"publicDomain" json:"publicDomain"`   // e.g. "pub.payne.io"
+	GatewayDomain  string `yaml:"gatewayDomain" json:"gatewayDomain"` // e.g. "payne.io" (internal)
 	CredentialsDir string `yaml:"credentialsDir" json:"credentialsDir"`
 }
 

internal/tunnel/manager_test.go

@@ -9,10 +9,10 @@ import (
 
 func testConfig() Config {
 	return Config{
-		Enabled:       true,
-		TunnelID:      "abc-123",
-		PublicDomain:  "pub.payne.io",
-		GatewayDomain: "payne.io",
+		Enabled:        true,
+		TunnelID:       "abc-123",
+		PublicDomain:   "pub.payne.io",
+		GatewayDomain:  "payne.io",
 		CredentialsDir: "/tmp/creds",
 	}
 }