Add central host-wide firewall allow/block lists

New model.IPListEntry + jsondb CRUD, independent of any single WireGuard
server. firewall.GenerateGlobalRuleset builds an nftables table
(wireguard_ui_global) with allow/block sets evaluated at priority -10 -
before every per-server table - so it applies to all traffic on the host,
not just WireGuard. Allow entries always win over block entries.
firewall.ApplyGlobal loads it live via `nft -f`, scoped to that one table.

New "Global Firewall Lists" page (nav entry under Settings): add/delete
entries, ruleset preview, "Apply now (live)" with an explicit confirm()
warning since this affects the whole host's firewall, not just one server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

model/iplist.go

@@ -0,0 +1,15 @@
+package model
+
+import "time"
+
+// IPListEntry is a single CIDR/IP entry in the host-wide allow or block
+// list. These are not scoped to a single WireGuard server - they apply to
+// the whole host, evaluated before any per-server firewall rules (see
+// firewall.GlobalTableName / firewall.GenerateGlobalRuleset).
+type IPListEntry struct {
+	ID        string    `json:"id"`
+	ListType  string    `json:"list_type"` // "allow" or "block"
+	CIDR      string    `json:"cidr"`
+	Comment   string    `json:"comment"`
+	CreatedAt time.Time `json:"created_at"`
+}