Device Groups: name a group of devices and target it in firewall rules

[ispyisail]

Summary

This is a rebase of lantis1008/gargoyle#57 onto current ispyisail/gargoyle master (that PR predates the move off lantis and was never merged there). Reimplements the Known Devices / Device Groups concept for OpenWrt 24.10 / nftables — name a group of devices on the DHCP page, then target that group in Restrictions, Quotas, and QoS instead of listing IPs/MACs by hand.

The three commits

1. nftables backend for named device groups

• known_devices.sh / manage_groups.sh — enumerate groups from config host sections and build/seed an nftables set (grp_<name>) per group from the current lease table.
• post_lease.sh — dnsmasq lease hook that adds/removes a device's IP from its group set at runtime (no firewall restart).
• gargoyle_firewall_util.sh — build the group sets before inserting restriction rules that reference them (ordering fix).
• make_nftables_rules.c / restore_quotas.c — resolve GROUP:<name> targets to the corresponding nftables set.

2. Unified Devices table on the DHCP page

• Replaces the separate Static IPs and Known Devices panels with one Devices table.
• Each device is a single config host section with an optional fixed IP, optional IPv6 reservation (behind an Advanced toggle), and optional group. MAC is the only required field.
• One host section per device — avoids the duplicate dhcp-host that the two-panel approach could generate.

3. Target a device group in Restrictions, Quotas and QoS

• Adds a Device Group option to the Applies To selector on each page.
• The option is hidden when no groups are defined yet.

Rebase notes

31 commits of drift had accumulated on master since this branch was created. One real conflict, in package/gargoyle/files/www/js/dhcp.js: master had picked up a standalone fix (a5f7d5c1, "Skip incomplete UCI host entries with empty MAC") for the old two-panel code. The Device Groups rewrite already carries an equivalent (and more complete) empty-MAC skip as part of its own unified-table design, so the incoming rewrite was taken as-is — verified the resulting file has no leftover conflict markers and passes node --check.

Verification

• Full make x86 FULL_BUILD=true in Docker: succeeded. make_nftables_rules.c and restore_quotas.c (the C sources this PR touches) compiled cleanly for all three x86 sub-architectures (one pre-existing, unrelated %c format warning in restore_quotas.c, not introduced by this change).
• Full vnet 3-site simulator suite against the resulting firmware: 112/117, matching the current baseline exactly (only the 5 documented TODO placeholders, every real phase shows PASS) — no regressions.
• Live functional smoke-test on a booted VM: added a config host section with a group field via UCI, ran manage_groups.sh, confirmed it created the correctly-named grp_<name> nftables set (empty, as expected with no matching DHCP lease for the synthetic test MAC).

Test plan

• Full firmware build (x86)
• Full vnet simulator suite (112/117, matches baseline)
• Live nftables group-set creation smoke-test
• Rebuild/flash across other targets — not yet done
• Full browser-driven UI walkthrough of the new Devices table — not yet done (backend/rebase verified; original PR author tested the UI previously on a GL.iNet MT6000)