Add resiliency primitives: atomic writes, reconcile mutex, state backup

- Add storage.WriteFileAtomic (temp + rename) and storage.CopyFile helpers
- Convert all 8 production config writers to atomic writes: config/state.yaml,
  dnsmasq, nftables, domains, wireguard (config + secrets + peers + wg0.conf),
  tunnel/cloudflared
- Add sync.Mutex to Reconciler to serialize concurrent Reconcile() calls
  triggered by domain registration goroutines
- Add state.yaml backup (.bak) before every write; LoadState falls back to
  backup if primary is corrupted
- Reconciler refuses to use empty config on corruption (only on first run
  when no state file exists yet)

internal/config/config_test.go

@@ -115,7 +115,7 @@ func TestLoadState_Errors(t *testing.T) {
 				}
 				return statePath
 			},
-			errContains: "parsing config file",
+			errContains: "yaml:",
 		},
 	}