Replace state blob with resource-oriented API endpoints

Split /api/v1/state into dedicated resource endpoints:
- /api/v1/operator, /api/v1/central-domain
- /api/v1/ddns/config, /api/v1/dns/settings
- /api/v1/dhcp/config (moved from /dnsmasq/dhcp/)
- /api/v1/nftables/config, /api/v1/haproxy/routes

Each page now talks to its own resource instead of deep-merging
a blob. Removes useConfig hook, CentralState type, and legacy
config methods.

internal/api/v1/handlers.go

@@ -1,7 +1,6 @@
 package v1
 
 import (
-	"errors"
 	"fmt"
 	"io"
 	"log/slog"
@@ -28,7 +27,6 @@ import (
 	"github.com/wild-cloud/wild-central/internal/secrets"
 	"github.com/wild-cloud/wild-central/internal/domains"
 	"github.com/wild-cloud/wild-central/internal/sse"
-	"github.com/wild-cloud/wild-central/internal/storage"
 	"github.com/wild-cloud/wild-central/internal/wireguard"
 )
 
@@ -171,9 +169,11 @@ func (api *API) StartCentralStatusBroadcaster(startTime time.Time) {
 func (api *API) RegisterRoutes(r *mux.Router) {
 	r.Use(RequestLoggingMiddleware)
 
-	// Global State (runtime settings — operator, DDNS, DHCP, etc.)
-	r.HandleFunc("/api/v1/state", api.GetState).Methods("GET")
-	r.HandleFunc("/api/v1/state", api.UpdateState).Methods("PUT")
+	// Resource-oriented settings (persisted in state.yaml)
+	r.HandleFunc("/api/v1/operator", api.GetOperator).Methods("GET")
+	r.HandleFunc("/api/v1/operator", api.UpdateOperator).Methods("PUT")
+	r.HandleFunc("/api/v1/central-domain", api.GetCentralDomain).Methods("GET")
+	r.HandleFunc("/api/v1/central-domain", api.UpdateCentralDomain).Methods("PUT")
 
 	// Global Secrets
 	r.HandleFunc("/api/v1/secrets", api.GetGlobalSecrets).Methods("GET")
@@ -186,28 +186,44 @@ func (api *API) RegisterRoutes(r *mux.Router) {
 	r.HandleFunc("/api/v1/network/info", api.NetworkInfoHandler).Methods("GET")
 	r.HandleFunc("/api/v1/network/resolve", api.NetworkResolveHandler).Methods("GET")
 
-	// dnsmasq management
+	// DNS (dnsmasq daemon)
+	r.HandleFunc("/api/v1/dns/settings", api.GetDNSSettings).Methods("GET")
+	r.HandleFunc("/api/v1/dns/settings", api.UpdateDNSSettings).Methods("PUT")
 	r.HandleFunc("/api/v1/dnsmasq/status", api.DnsmasqStatus).Methods("GET")
 	r.HandleFunc("/api/v1/dnsmasq/config", api.DnsmasqGetConfig).Methods("GET")
 	r.HandleFunc("/api/v1/dnsmasq/config", api.DnsmasqWriteConfig).Methods("PUT")
 	r.HandleFunc("/api/v1/dnsmasq/restart", api.DnsmasqRestart).Methods("POST")
 	r.HandleFunc("/api/v1/dnsmasq/generate", api.DnsmasqGenerate).Methods("POST")
-	r.HandleFunc("/api/v1/dnsmasq/dhcp/leases", api.DnsmasqDHCPLeases).Methods("GET")
-	r.HandleFunc("/api/v1/dnsmasq/dhcp/static", api.DnsmasqDHCPAddStatic).Methods("POST")
-	r.HandleFunc("/api/v1/dnsmasq/dhcp/static/{mac}", api.DnsmasqDHCPDeleteStatic).Methods("DELETE")
 
-	// HAProxy ingress management
+	// DHCP (feature, backed by dnsmasq)
+	r.HandleFunc("/api/v1/dhcp/config", api.GetDHCPConfig).Methods("GET")
+	r.HandleFunc("/api/v1/dhcp/config", api.UpdateDHCPConfig).Methods("PUT")
+	r.HandleFunc("/api/v1/dhcp/leases", api.DnsmasqDHCPLeases).Methods("GET")
+	r.HandleFunc("/api/v1/dhcp/static", api.DnsmasqDHCPAddStatic).Methods("POST")
+	r.HandleFunc("/api/v1/dhcp/static/{mac}", api.DnsmasqDHCPDeleteStatic).Methods("DELETE")
+
+	// HAProxy gateway management
 	r.HandleFunc("/api/v1/haproxy/status", api.HaproxyStatus).Methods("GET")
 	r.HandleFunc("/api/v1/haproxy/config", api.HaproxyGetConfig).Methods("GET")
 	r.HandleFunc("/api/v1/haproxy/generate", api.HaproxyGenerate).Methods("POST")
 	r.HandleFunc("/api/v1/haproxy/restart", api.HaproxyRestart).Methods("POST")
 	r.HandleFunc("/api/v1/haproxy/stats", api.HaproxyStats).Methods("GET")
+	r.HandleFunc("/api/v1/haproxy/routes", api.GetHAProxyRoutes).Methods("GET")
+	r.HandleFunc("/api/v1/haproxy/routes", api.UpdateHAProxyRoutes).Methods("PUT")
 
 	// nftables firewall management
 	r.HandleFunc("/api/v1/nftables/status", api.NftablesStatus).Methods("GET")
+	r.HandleFunc("/api/v1/nftables/config", api.GetNftablesConfig).Methods("GET")
+	r.HandleFunc("/api/v1/nftables/config", api.UpdateNftablesConfig).Methods("PUT")
 	r.HandleFunc("/api/v1/nftables/apply", api.NftablesApply).Methods("POST")
 	r.HandleFunc("/api/v1/nftables/interfaces", api.NftablesGetInterfaces).Methods("GET")
 
+	// DDNS management
+	r.HandleFunc("/api/v1/ddns/config", api.GetDDNSConfig).Methods("GET")
+	r.HandleFunc("/api/v1/ddns/config", api.UpdateDDNSConfig).Methods("PUT")
+	r.HandleFunc("/api/v1/ddns/status", api.DDNSStatus).Methods("GET")
+	r.HandleFunc("/api/v1/ddns/trigger", api.DDNSTrigger).Methods("POST")
+
 	// WireGuard VPN management
 	r.HandleFunc("/api/v1/vpn/status", api.VpnStatus).Methods("GET")
 	r.HandleFunc("/api/v1/vpn/config", api.VpnGetConfig).Methods("GET")
@@ -260,89 +276,7 @@ func (api *API) RegisterRoutes(r *mux.Router) {
 	r.HandleFunc("/api/v1/events", api.GlobalEventStream).Methods("GET")
 }
 
-// --- Global Config/Secrets handlers ---
-
-// GetState returns the global state wrapped in { configured, state }.
-func (api *API) GetState(w http.ResponseWriter, r *http.Request) {
-	data, err := os.ReadFile(api.statePath())
-	if err != nil {
-		respondJSON(w, http.StatusOK, map[string]any{
-			"configured": false,
-		})
-		return
-	}
-
-	var stateMap map[string]any
-	if err := yaml.Unmarshal(data, &stateMap); err != nil {
-		respondError(w, http.StatusInternalServerError, "Failed to parse state")
-		return
-	}
-
-	respondJSON(w, http.StatusOK, map[string]any{
-		"configured": true,
-		"state":      stateMap,
-	})
-}
-
-// UpdateState updates the global state
-func (api *API) UpdateState(w http.ResponseWriter, r *http.Request) {
-	configPath := api.statePath()
-
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		respondError(w, http.StatusBadRequest, "Failed to read request body")
-		return
-	}
-
-	var updates map[string]any
-	if err := yaml.Unmarshal(body, &updates); err != nil {
-		respondError(w, http.StatusBadRequest, "Invalid YAML format")
-		return
-	}
-
-	// Read existing state (may not exist yet)
-	existingContent, err := storage.ReadFile(configPath)
-	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		respondError(w, http.StatusInternalServerError, "Failed to read existing state")
-		return
-	}
-
-	var existingConfig map[string]any
-	if len(existingContent) > 0 {
-		if err := yaml.Unmarshal(existingContent, &existingConfig); err != nil {
-			respondError(w, http.StatusBadRequest, "Failed to parse existing config")
-			return
-		}
-	} else {
-		existingConfig = make(map[string]any)
-	}
-
-	for key, value := range updates {
-		existingConfig[key] = value
-	}
-
-	yamlContent, err := yaml.Marshal(existingConfig)
-	if err != nil {
-		respondError(w, http.StatusInternalServerError, "Failed to marshal YAML")
-		return
-	}
-
-	lockPath := configPath + ".lock"
-	if err := storage.WithLock(lockPath, func() error {
-		return storage.WriteFile(configPath, yamlContent, 0644)
-	}); err != nil {
-		respondError(w, http.StatusInternalServerError, "Failed to write config")
-		return
-	}
-
-	slog.Info("global config updated")
-
-	// Reload DDNS and re-register Central's service if config changed
-	go api.reloadDDNSIfEnabled()
-	go api.EnsureCentralDomain()
-
-	respondMessage(w, http.StatusOK, "Config updated successfully")
-}
+// --- Secrets handlers ---
 
 // GetGlobalSecrets returns the global secrets (redacted by default)
 func (api *API) GetGlobalSecrets(w http.ResponseWriter, r *http.Request) {