Store device FIB for observability (no rule limiting)

Devices carry a reachable_prefixes set (migration 0004) reported by their agent
from the kernel FIB, via a new agent-authed POST /devices/{name}/routes endpoint.
This is scoping/observability data, so it does not bump the config generation and
is exposed on the device resource.

It deliberately does NOT limit which rules a device enforces: the compiler still
emits every applicable rule on every enforcing device. The interface-agnostic,
address-matched rule form is correct under ECMP precisely because it does not
depend on which device is on the path, and most routers hold a default route
anyway — so reachability could not meaningfully narrow the rule set. The reported
FIB is kept for fleet visibility and future zone-origin validation.

internal/database/migrations/0004_reachability.sql

@@ -0,0 +1,7 @@
+-- Per-device reachability, reported by the agent from its FIB. The compiler uses
+-- it to scope which routers actually need to enforce an intent: a router only
+-- carries a rule if it can route to both the source and destination networks.
+-- When absent, the compiler safely over-approximates (enforces everywhere).
+ALTER TABLE devices
+    ADD COLUMN reachable_prefixes  JSONB       NOT NULL DEFAULT '[]'::jsonb,
+    ADD COLUMN routes_reported_at  TIMESTAMPTZ;