Add central host-wide firewall allow/block lists

New model.IPListEntry + jsondb CRUD, independent of any single WireGuard
server. firewall.GenerateGlobalRuleset builds an nftables table
(wireguard_ui_global) with allow/block sets evaluated at priority -10 -
before every per-server table - so it applies to all traffic on the host,
not just WireGuard. Allow entries always win over block entries.
firewall.ApplyGlobal loads it live via `nft -f`, scoped to that one table.

New "Global Firewall Lists" page (nav entry under Settings): add/delete
entries, ruleset preview, "Apply now (live)" with an explicit confirm()
warning since this affects the whole host's firewall, not just one server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

store/store.go

@@ -38,4 +38,7 @@ type IStore interface {
 	CreateFirewallRule(rule model.FirewallRule) error
 	UpdateFirewallRule(rule model.FirewallRule) error
 	DeleteFirewallRule(serverID, ruleID string) error
+	GetIPListEntries() ([]model.IPListEntry, error)
+	CreateIPListEntry(entry model.IPListEntry) error
+	DeleteIPListEntry(id string) error
 }