Add central ASN address-group expander

Expand asn address groups to concrete prefixes centrally (one iplocate key,
consistent fleet-wide) and refresh them on a per-group TTL (default 24h). A
background Refresher scans for due groups, unions each group's ASNs to a deduped
prefix set, and writes them to a new resolved/resolved_at column (migration
0002). Fail-safe: a lookup error or empty expansion keeps the last-good set,
never emptying it. The compiler folds resolved prefixes into the rendered set
members; membership churn bumps the generation but never rewrites rules. The
iplocate client is endpoint-configurable and response-tolerant, documented as
needing endpoint/key confirmation. Unit tests cover TTL parsing, due-checks, and
union/dedup/error propagation with a fake expander.

internal/model/model.go

@@ -5,6 +5,7 @@ package model
 import (
 	"fmt"
 	"strings"
+	"time"
 )
 
 // DeviceClass is either a routed-core member or a zone-boundary firewall.
@@ -75,6 +76,11 @@ type AddressGroup struct {
 	Members     []string         `json:"members"`
 	Refresh     string           `json:"refresh,omitempty"`
 	Description string           `json:"description,omitempty"`
+
+	// Resolved holds concrete CIDRs the ASN expander last produced (asn groups
+	// only); ResolvedAt timestamps that expansion. Both are server-managed.
+	Resolved   []string   `json:"resolved,omitempty"`
+	ResolvedAt *time.Time `json:"resolved_at,omitempty"`
 }
 
 // SetName returns the nftables set name for this group. ASN groups get the