Different blocking for different devices: steps and client groups

Client groups put devices (addresses, networks, or ACLs of them) at a
blocking step: off (only your rules), normal (the default), or steps
added above it, each including the lists of the steps below. Lists
start at a step. In each view, a gate policy zone in front of a step's
lists lets the devices below that step through (rpz-client-ip triggers
with rpz-passthru), so every list is still loaded once. The IPv6 part
of a gate leaves the IPv4-mapped range out: named matches IPv4 clients
as ::ffff:a.b.c.d.

Web UI: a Devices panel on the Blocking page and a step on each list.
CLI: jarl block step, jarl block group, jarl blocklist --step. API:
/blocking/steps, /blocking/groups. Database schema 8.

Also: copying the state kept empty lists as empty (not nil), so
reverting a changeset no longer adds restore operations for unchanged
blocklists, rules and views.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/expand.go

@@ -264,6 +264,30 @@ func (x *expander) expand(req Request) ([]model.Op, error) {
 			verb = "delete rule: "
 		}
 		return []model.Op{x.versioned(req, r.Version, verb+ruleLabel(r))}, nil
+	case OpBlockStepCreate:
+		return x.blockStepCreate(req)
+	case OpBlockStepUpdate, OpBlockStepDelete:
+		s := x.st.BlockSteps[req.ID]
+		if s == nil {
+			return nil, errf(KindNotFound, "blocking step %d does not exist", req.ID)
+		}
+		verb := "change blocking step "
+		if req.Op == OpBlockStepDelete {
+			verb = "delete blocking step "
+		}
+		return []model.Op{x.versioned(req, s.Version, verb+s.Name)}, nil
+	case OpClientGroupCreate:
+		return x.clientGroupCreate(req)
+	case OpClientGroupUpdate, OpClientGroupDelete:
+		g := x.st.ClientGroups[req.ID]
+		if g == nil {
+			return nil, errf(KindNotFound, "client group %d does not exist", req.ID)
+		}
+		verb := "change client group "
+		if req.Op == OpClientGroupDelete {
+			verb = "delete client group "
+		}
+		return []model.Op{x.versioned(req, g.Version, verb+g.Name)}, nil
 	}
 	return nil, errf(KindBadRequest, "unknown operation %q", req.Op)
 }