Store device FIB for observability (no rule limiting)

Devices carry a reachable_prefixes set (migration 0004) reported by their agent
from the kernel FIB, via a new agent-authed POST /devices/{name}/routes endpoint.
This is scoping/observability data, so it does not bump the config generation and
is exposed on the device resource.

It deliberately does NOT limit which rules a device enforces: the compiler still
emits every applicable rule on every enforcing device. The interface-agnostic,
address-matched rule form is correct under ECMP precisely because it does not
depend on which device is on the path, and most routers hold a default route
anyway — so reachability could not meaningfully narrow the rule set. The reported
FIB is kept for fleet visibility and future zone-origin validation.

internal/server/server.go

@@ -94,6 +94,7 @@ func (s *Server) routes() http.Handler {
 			r.Use(s.requireToken(s.agentToken))
 			r.Get("/devices/{name}/config", s.handleDeviceConfig)
 			r.Post("/devices/{name}/status", s.handleDeviceStatus)
+			r.Post("/devices/{name}/routes", s.handleDeviceRoutes)
 		})
 	})