Scope client management and config-apply per server (step 4)

Real per-server data isolation, the core ask behind the access-control
work: clients, config generation, and the client-management UI are now
scoped by server ID instead of implicitly operating on one global
"the server".

- util.DefaultServerID ("wg0") is the server every legacy bare route
  now resolves to, so old and new routes share one consistent identity
  instead of drifting apart.
- New /servers/:id/... routes (new-client, update-client, remove-client,
  set-status, download, api/clients, api/client/:cid, api/apply-wg-config)
  reuse the same handlers as the legacy routes via resolveServerID(c),
  gated by RequireServerAccess middleware. Cross-server edits/deletes on
  scoped routes are rejected (403) if a client belongs to a different
  server.
- Fixes a real data leak: ApplyServerConfig previously wrote ALL clients
  from ALL servers into whichever single wg.conf it targeted. It now
  filters clients by server ID before generating a config, and resolves
  each server's own ConfigFilePath/EndpointAddress via the new
  ServerSetting record instead of the app-wide GlobalSetting.
- WireGuardServerInterfaces/WireGuardServerKeyPair/GlobalSettingSubmit
  (the legacy /wg-server and /global-settings edit routes) now write
  through to the new per-server registry record for "wg0" in addition
  to the legacy collection, so the two stay in sync until the legacy
  routes are eventually retired.
- New templates/server_clients.html: per-server clone of clients.html
  wired to the scoped endpoints, with a server name/id heading.
- base.html's shared "New Client" and "Apply Config" actions (used by
  every page's nav buttons) now target the scoped route when a
  serverID is present on the page, instead of always hitting the
  legacy default-server endpoint regardless of which server's client
  page is open.

Legacy bare routes (/, /new-client, /wg-server, ...) are untouched and
still fully functional against the default "wg0" server - nothing was
removed yet, per the incremental-delivery approach for this project.

templates/base.html

@@ -502,7 +502,7 @@
             $.ajax({
                 cache: false,
                 method: 'POST',
-                url: '{{.basePath}}/new-client',
+                url: '{{if .serverID}}{{.basePath}}/servers/{{.serverID}}/new-client{{else}}{{.basePath}}/new-client{{end}}',
                 dataType: 'json',
                 contentType: "application/json",
                 data: JSON.stringify(data),
@@ -512,6 +512,11 @@
                     // Update the home page (clients page) after adding successfully
                     if (window.location.pathname === "{{.basePath}}/") {
                         populateClient(resp.id);
+                    } else if ("{{.serverID}}" !== "") {
+                        // per-server clients page: no in-place row injection
+                        // wired up (server-scoped client ids need a scoped
+                        // GET too), just reload to show the new client
+                        location.reload();
                     }
                     updateApplyConfigVisibility()
                 },
@@ -656,7 +661,7 @@
                 $.ajax({
                     cache: false,
                     method: 'POST',
-                    url: '{{.basePath}}/api/apply-wg-config',
+                    url: '{{if .serverID}}{{.basePath}}/servers/{{.serverID}}/api/apply-wg-config{{else}}{{.basePath}}/api/apply-wg-config{{end}}',
                     dataType: 'json',
                     contentType: "application/json",
                     success: function(data) {