Replace state blob with resource-oriented API endpoints

Split /api/v1/state into dedicated resource endpoints:
- /api/v1/operator, /api/v1/central-domain
- /api/v1/ddns/config, /api/v1/dns/settings
- /api/v1/dhcp/config (moved from /dnsmasq/dhcp/)
- /api/v1/nftables/config, /api/v1/haproxy/routes

Each page now talks to its own resource instead of deep-merging
a blob. Removes useConfig hook, CentralState type, and legacy
config methods.

web/src/components/FirewallComponent.tsx

@@ -7,9 +7,10 @@ import { Alert, AlertDescription } from './ui/alert';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from './ui/select';
 import { Shield, Loader2, AlertCircle, CheckCircle, Check, X, Plus, Trash2, BookOpen, ChevronDown, ChevronUp, Lock } from 'lucide-react';
 import { Badge } from './ui/badge';
-import { useConfig } from '../hooks';
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { useNftables } from '../hooks/useNftables';
 import { useVpn } from '../hooks/useVpn';
+import { nftablesConfigApi, haproxyRoutesApi } from '../services/api/settings';
 
 type ExtraPort = { port: number; protocol?: string; label?: string };
 
@@ -38,15 +39,20 @@ interface PortEntry {
 }
 
 export function FirewallComponent() {
-  const { config: globalConfig, updateConfig } = useConfig();
+  const queryClient = useQueryClient();
+  const { data: nftCfg } = useQuery({ queryKey: ['nftables', 'config'], queryFn: () => nftablesConfigApi.get() });
+  const { data: haproxyRoutes } = useQuery({ queryKey: ['haproxy', 'routes'], queryFn: () => haproxyRoutesApi.get() });
+  const nftMutation = useMutation({
+    mutationFn: (data: Parameters<typeof nftablesConfigApi.update>[0]) => nftablesConfigApi.update(data),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ['nftables', 'config'] }),
+  });
   const { status: nftablesStatus, isLoadingStatus: isNftablesLoading, interfaces, refetchStatus } = useNftables();
   const { config: vpnConfig } = useVpn();
 
-  const nftCfg = globalConfig?.cloud?.nftables;
   const isEnabled = nftCfg?.enabled !== false;
   const currentWan = nftCfg?.wanInterface ?? '';
   const currentExtraPorts: ExtraPort[] = nftCfg?.extraPorts ?? [];
-  const customRoutes = globalConfig?.cloud?.haproxy?.customRoutes ?? [];
+  const customRoutes = haproxyRoutes?.customRoutes ?? [];
 
   const [editingWan, setEditingWan] = useState(false);
   const [wanValue, setWanValue] = useState('');
@@ -121,15 +127,8 @@ export function FirewallComponent() {
   const tcpPorts = allPorts.filter(p => p.protocol === 'tcp');
   const udpPorts = allPorts.filter(p => p.protocol === 'udp');
 
-  async function saveNftConfig(patch: NonNullable<NonNullable<typeof globalConfig>['cloud']>['nftables']) {
-    if (!globalConfig) return;
-    await updateConfig({
-      ...globalConfig,
-      cloud: {
-        ...globalConfig.cloud,
-        nftables: { ...nftCfg, ...patch },
-      },
-    });
+  async function saveNftConfig(patch: Partial<NonNullable<typeof nftCfg>>) {
+    await nftMutation.mutateAsync(patch);
     refetchStatus();
   }