Add per-server settings editor (step 5)

New servers previously got a bare ConfigFilePath default with no way
to set/edit EndpointAddress, FirewallMark, or Table afterward. Adds
GET/POST /servers/:id/settings (view/save ServerSetting, admin-only
for writes) and a "Settings" button + modal on each server card in
servers.html. CreateServer now seeds FirewallMark/Table with the same
defaults the legacy single-server bootstrap uses, instead of leaving
them blank.

handler/routes.go

@@ -592,6 +592,43 @@ func GetServerClients(db store.IStore) echo.HandlerFunc {
 	}
 }
 
+// GetServerSettings handler returns a single server's per-server settings
+// (endpoint address, table, firewall mark, config file path) as JSON.
+func GetServerSettings(db store.IStore) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		serverID := c.Param("id")
+		settings, err := db.GetServerSettings(serverID)
+		if err != nil {
+			return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, "Server settings not found"})
+		}
+		return c.JSON(http.StatusOK, settings)
+	}
+}
+
+// SaveServerSettingsHandler updates a single server's per-server settings.
+// Admin-only (registered with handler.NeedsAdmin).
+func SaveServerSettingsHandler(db store.IStore) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		serverID := c.Param("id")
+		if _, err := db.GetServerByID(serverID); err != nil {
+			return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, "Server not found"})
+		}
+
+		var settings model.ServerSetting
+		if err := c.Bind(&settings); err != nil {
+			return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
+		}
+		settings.UpdatedAt = time.Now().UTC()
+
+		if err := db.SaveServerSettings(serverID, settings); err != nil {
+			return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, fmt.Sprintf("Cannot save server settings: %v", err)})
+		}
+		log.Infof("Updated settings for server %s", serverID)
+
+		return c.JSON(http.StatusOK, jsonHTTPResponse{true, "Updated server settings successfully"})
+	}
+}
+
 // CreateServer handler creates a new WireGuard server (step 3 of the
 // multi-server extension). Admin-only. Generates a fresh key pair,
 // validates the ID/interface name/subnet, and stores the server plus its
@@ -658,6 +695,8 @@ func CreateServer(db store.IStore) echo.HandlerFunc {
 
 		settings := model.ServerSetting{
 			ConfigFilePath: fmt.Sprintf("/etc/wireguard/%s.conf", req.Interface),
+			FirewallMark:   util.DefaultFirewallMark,
+			Table:          util.DefaultTable,
 			UpdatedAt:      time.Now().UTC(),
 		}
 		if err := db.SaveServerSettings(req.ID, settings); err != nil {