Add Postgres storage layer and CRUD handlers

Add the store package (pgx-backed repository) with CRUD for the core resources
the compiler needs: fabrics, zones, address groups, portgroups, devices,
bindings, rules, policies. Every mutation bumps a global config generation.
Wire real JSON CRUD handlers with token auth, source/dest grammar validation on
rule create, and the agent status-report endpoint. Migration 0001 verified
against Postgres 17.

internal/model/model.go

@@ -24,6 +24,25 @@ const (
 	GroupASN    AddressGroupType = "asn"    // ASNs, expanded centrally via iplocate
 )
 
+// Fabric is a routing domain. EnforceOnRouters toggles defense-in-depth (every
+// router carries the intent) vs transparent transit (only boundary firewalls do).
+type Fabric struct {
+	Name             string `json:"name"`
+	EnforceOnRouters bool   `json:"enforce_on_routers"`
+	Description      string `json:"description,omitempty"`
+}
+
+// Policy is a fleet-global default zone-to-zone posture. Lower priority evaluates
+// first (first match wins).
+type Policy struct {
+	ID       int64  `json:"id"`
+	Priority int    `json:"priority"`
+	Source   string `json:"source"`
+	Dest     string `json:"dest"`
+	Action   string `json:"action"`
+	Log      string `json:"log,omitempty"`
+}
+
 // Zone is a fleet-global network segment.
 type Zone struct {
 	Name    string   `json:"name" yaml:"-"`