Add per-device config compiler and agent config endpoint

Project the fleet-global model through a device's bindings into a rendered,
interface-agnostic config: rules compile to saddr/daddr forward matches with no
iif/oif so they are correct under FRR/ECMP. Firewalls always enforce; routers
enforce only when their fabric opts into defense-in-depth. Referenced address
groups are emitted as named sets carrying their source (static CIDRs, dns FQDNs,
or asn numbers) so membership churns out-of-band without a rule reload. Wire
GET /devices/{name}/config to compile and serve YAML, generation-stamped. Add
portgroups/policies/settings store methods and portgroup CRUD. Pure Render is
unit-tested for enforcement gating, ASN set emission, and resolver precedence.

internal/model/model.go

@@ -24,6 +24,23 @@ const (
 	GroupASN    AddressGroupType = "asn"    // ASNs, expanded centrally via iplocate
 )
 
+// Settings holds fleet-wide defaults. Individual devices may override a subset
+// via their per-device settings.
+type Settings struct {
+	AddressFamily   string   `json:"address_family"`
+	LogLevel        string   `json:"log_level"`
+	IPForwarding    bool     `json:"ip_forwarding"`
+	TableName       string   `json:"table_name"`
+	DefaultResolver []string `json:"default_resolver"`
+}
+
+// PortGroup is a reusable proto+ports combo referenced by rules.
+type PortGroup struct {
+	Name  string   `json:"name"`
+	Proto string   `json:"proto"`
+	Ports []string `json:"ports"`
+}
+
 // Fabric is a routing domain. EnforceOnRouters toggles defense-in-depth (every
 // router carries the intent) vs transparent transit (only boundary firewalls do).
 type Fabric struct {