Different blocking for different devices: steps and client groups

Client groups put devices (addresses, networks, or ACLs of them) at a
blocking step: off (only your rules), normal (the default), or steps
added above it, each including the lists of the steps below. Lists
start at a step. In each view, a gate policy zone in front of a step's
lists lets the devices below that step through (rpz-client-ip triggers
with rpz-passthru), so every list is still loaded once. The IPv6 part
of a gate leaves the IPv4-mapped range out: named matches IPv4 clients
as ::ffff:a.b.c.d.

Web UI: a Devices panel on the Blocking page and a step on each list.
CLI: jarl block step, jarl block group, jarl blocklist --step. API:
/blocking/steps, /blocking/groups. Database schema 8.

Also: copying the state kept empty lists as empty (not nil), so
reverting a changeset no longer adds restore operations for unchanged
blocklists, rules and views.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/blockops.go

@@ -117,6 +117,16 @@ func applyBlocklistPut(st *model.State, op model.Op, c *applyCtx) error {
 	if in.Disabled != nil {
 		b.Disabled = *in.Disabled
 	}
+	step, given, err := stepRef(st, in.Step, in.StepID)
+	if err != nil {
+		return err
+	}
+	if given {
+		if step == model.StepOff {
+			return errf(KindBadRequest, "a blocklist starts at normal or a step above it, not off")
+		}
+		b.StepID = step
+	}
 	if in.Comment != nil {
 		b.Comment = *in.Comment
 	}
@@ -226,6 +236,11 @@ func blockingUsers(st *model.State, viewID int64) []string {
 			out = append(out, ruleLabel(r))
 		}
 	}
+	for _, g := range st.SortedClientGroups() {
+		if slices.Contains(g.ViewIDs, viewID) {
+			out = append(out, "client group "+g.Name)
+		}
+	}
 	return out
 }