Store device FIB for observability (no rule limiting)

Devices carry a reachable_prefixes set (migration 0004) reported by their agent
from the kernel FIB, via a new agent-authed POST /devices/{name}/routes endpoint.
This is scoping/observability data, so it does not bump the config generation and
is exposed on the device resource.

It deliberately does NOT limit which rules a device enforces: the compiler still
emits every applicable rule on every enforcing device. The interface-agnostic,
address-matched rule form is correct under ECMP precisely because it does not
depend on which device is on the path, and most routers hold a default route
anyway — so reachability could not meaningfully narrow the rule set. The reported
FIB is kept for fleet visibility and future zone-origin validation.

internal/model/model.go

@@ -99,6 +99,10 @@ type Device struct {
 	Fabric   string            `json:"fabric,omitempty"`
 	Resolver []string          `json:"resolver,omitempty"`
 	Settings map[string]string `json:"settings,omitempty"`
+
+	// ReachablePrefixes is the device's FIB as last reported by its agent
+	// (server-managed). The compiler uses it to scope router enforcement.
+	ReachablePrefixes []string `json:"reachable_prefixes,omitempty"`
 }
 
 // Binding maps a global zone to one device's local interface(s).