Add global-tier long-tail resources: policy CRUD, blrules, conntrack

- Wire policy CRUD (the policies table existed from 0001 but had no endpoint;
  policies already render in the compiler, so this closes that loop).
- Add blrules (blacklist/whitelist) and conntrack resources: migration 0005,
  model types, id-keyed store CRUD (generation-bumping), and REST handlers.
Compiler rendering of blrules/conntrack into device configs is a tracked
follow-up (policy already renders).

internal/server/longtail.go

@@ -0,0 +1,158 @@
+package server
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.unkin.net/unkin/tomswallapi/internal/model"
+)
+
+// mountLongtail wires the global-compiled long-tail resources: policies (default
+// posture), blrules (blacklist/whitelist), and conntrack.
+func (s *Server) mountLongtail(r chi.Router) {
+	r.Route("/policies", func(r chi.Router) {
+		r.Get("/", s.listPolicies)
+		r.Post("/", s.createPolicy)
+		r.Get("/{id}", s.getPolicy)
+		r.Delete("/{id}", s.deletePolicy)
+	})
+	r.Route("/blrules", func(r chi.Router) {
+		r.Get("/", s.listBlrules)
+		r.Post("/", s.createBlrule)
+		r.Get("/{id}", s.getBlrule)
+		r.Delete("/{id}", s.deleteBlrule)
+	})
+	r.Route("/conntrack", func(r chi.Router) {
+		r.Get("/", s.listConntrack)
+		r.Post("/", s.createConntrack)
+		r.Get("/{id}", s.getConntrack)
+		r.Delete("/{id}", s.deleteConntrack)
+	})
+}
+
+// ---- Policies --------------------------------------------------------------
+
+func (s *Server) listPolicies(w http.ResponseWriter, r *http.Request) {
+	list, err := s.store.ListPolicies(r.Context())
+	respondList(w, list, err)
+}
+
+func (s *Server) createPolicy(w http.ResponseWriter, r *http.Request) {
+	var v model.Policy
+	if !decode(w, r, &v) {
+		return
+	}
+	if v.Action == "" {
+		writeError(w, http.StatusBadRequest, "action is required")
+		return
+	}
+	id, err := s.store.CreatePolicy(r.Context(), v)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	v.ID = id
+	writeJSON(w, http.StatusCreated, v)
+}
+
+func (s *Server) getPolicy(w http.ResponseWriter, r *http.Request) {
+	id, ok := idParam(w, r)
+	if !ok {
+		return
+	}
+	v, err := s.store.GetPolicy(r.Context(), id)
+	respondOne(w, v, err)
+}
+
+func (s *Server) deletePolicy(w http.ResponseWriter, r *http.Request) {
+	id, ok := idParam(w, r)
+	if !ok {
+		return
+	}
+	respondDelete(w, s.store.DeletePolicy(r.Context(), id))
+}
+
+// ---- Blrules ---------------------------------------------------------------
+
+func (s *Server) listBlrules(w http.ResponseWriter, r *http.Request) {
+	list, err := s.store.ListBlrules(r.Context())
+	respondList(w, list, err)
+}
+
+func (s *Server) createBlrule(w http.ResponseWriter, r *http.Request) {
+	var v model.BlruleRule
+	if !decode(w, r, &v) {
+		return
+	}
+	if v.Action == "" {
+		writeError(w, http.StatusBadRequest, "action is required")
+		return
+	}
+	id, err := s.store.CreateBlrule(r.Context(), v)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	v.ID = id
+	writeJSON(w, http.StatusCreated, v)
+}
+
+func (s *Server) getBlrule(w http.ResponseWriter, r *http.Request) {
+	id, ok := idParam(w, r)
+	if !ok {
+		return
+	}
+	v, err := s.store.GetBlrule(r.Context(), id)
+	respondOne(w, v, err)
+}
+
+func (s *Server) deleteBlrule(w http.ResponseWriter, r *http.Request) {
+	id, ok := idParam(w, r)
+	if !ok {
+		return
+	}
+	respondDelete(w, s.store.DeleteBlrule(r.Context(), id))
+}
+
+// ---- Conntrack -------------------------------------------------------------
+
+func (s *Server) listConntrack(w http.ResponseWriter, r *http.Request) {
+	list, err := s.store.ListConntrack(r.Context())
+	respondList(w, list, err)
+}
+
+func (s *Server) createConntrack(w http.ResponseWriter, r *http.Request) {
+	var v model.ConntrackRule
+	if !decode(w, r, &v) {
+		return
+	}
+	if v.Action == "" {
+		writeError(w, http.StatusBadRequest, "action is required")
+		return
+	}
+	id, err := s.store.CreateConntrack(r.Context(), v)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	v.ID = id
+	writeJSON(w, http.StatusCreated, v)
+}
+
+func (s *Server) getConntrack(w http.ResponseWriter, r *http.Request) {
+	id, ok := idParam(w, r)
+	if !ok {
+		return
+	}
+	v, err := s.store.GetConntrack(r.Context(), id)
+	respondOne(w, v, err)
+}
+
+func (s *Server) deleteConntrack(w http.ResponseWriter, r *http.Request) {
+	id, ok := idParam(w, r)
+	if !ok {
+		return
+	}
+	respondDelete(w, s.store.DeleteConntrack(r.Context(), id))
+}

internal/server/resources.go

@@ -60,6 +60,7 @@ func (s *Server) mountResources(r chi.Router) {
 		r.Delete("/{id}", s.deleteRule)
 	})
 	s.mountNAT(r)
+	s.mountLongtail(r)
 }
 
 // respondOne writes a single resource, mapping ErrNotFound to 404.