Store device FIB for observability (no rule limiting)

Devices carry a reachable_prefixes set (migration 0004) reported by their agent
from the kernel FIB, via a new agent-authed POST /devices/{name}/routes endpoint.
This is scoping/observability data, so it does not bump the config generation and
is exposed on the device resource.

It deliberately does NOT limit which rules a device enforces: the compiler still
emits every applicable rule on every enforcing device. The interface-agnostic,
address-matched rule form is correct under ECMP precisely because it does not
depend on which device is on the path, and most routers hold a default route
anyway — so reachability could not meaningfully narrow the rule set. The reported
FIB is kept for fleet visibility and future zone-origin validation.

internal/compiler/compiler.go

@@ -131,6 +131,10 @@ func Render(in Input) (*RenderedConfig, error) {
 
 	usedSets := map[string]model.AddressGroup{}
 
+	// Every enforcing device carries every applicable rule: the interface-agnostic
+	// address-matched form is correct under ECMP precisely because it does not
+	// depend on which device is on the path (over-approximation is safe). Reported
+	// FIBs are stored for observability/validation, not to limit rules.
 	if out.Enforcing {
 		for _, rule := range in.Rules {
 			rr, err := renderRule(in, rule, usedSets)