Add global-tier long-tail resources: policy CRUD, blrules, conntrack

- Wire policy CRUD (the policies table existed from 0001 but had no endpoint;
  policies already render in the compiler, so this closes that loop).
- Add blrules (blacklist/whitelist) and conntrack resources: migration 0005,
  model types, id-keyed store CRUD (generation-bumping), and REST handlers.
Compiler rendering of blrules/conntrack into device configs is a tracked
follow-up (policy already renders).

internal/server/resources.go

@@ -60,6 +60,7 @@ func (s *Server) mountResources(r chi.Router) {
 		r.Delete("/{id}", s.deleteRule)
 	})
 	s.mountNAT(r)
+	s.mountLongtail(r)
 }
 
 // respondOne writes a single resource, mapping ErrNotFound to 404.