feat(security): auto-detect local networks, hot-reload config, and 403 handling

[laolusrael]

Summary

Implements automatic local network detection, hot-reloadable configuration, and proper 403 access denied handling.

Changes

Security

• Auto-detect local networks: On first run, \DetectLocalNetworks()\ scans all interfaces for RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) plus loopback (127.0.0.0/8)
• IP whitelist always active: Removed the no-op bypass when \�llowed_ips\ was empty - now returns 403 Forbidden
• Migration safety: Existing installations with empty \�llowed_ips\ get auto-detected networks at runtime (without modifying config file)
• /api/health now protected: Moved inside the API group so health checks also require whitelisted IP

Hot-Reload

• ConfigManager: Thread-safe config access with \sync.RWMutex, reads applied per-request by middleware
• Hot-reloadable settings: \�llowed_ips, logging (level/format/output), multipass timeout, SSH key path apply immediately
• Require restart: \server.host\ and \server.port\ still need restart
• Settings UX: Shows success or restart-required message based on what was changed

Frontend

• /unauthorized page: Dedicated 403 access denied page with grayscale design
• +error.svelte: Standard SvelteKit error page
• 403 redirect: API service detects 403 and redirects to /unauthorized
• Fixed duplicate types: Removed duplicate \InstanceState\ and \SnapshotList\ definitions

Files Changed (18)

• 3 new files: \config_manager.go, +error.svelte, \unauthorized/+page.svelte\
• 15 modified files across backend and frontend

Testing

• All Go tests pass (70+ tests)
• Frontend builds successfully
• Added hot-reload test for IP whitelist middleware
• Updated existing tests for ConfigManager integration