Different blocking for different devices: steps and client groups

Client groups put devices (addresses, networks, or ACLs of them) at a
blocking step: off (only your rules), normal (the default), or steps
added above it, each including the lists of the steps below. Lists
start at a step. In each view, a gate policy zone in front of a step's
lists lets the devices below that step through (rpz-client-ip triggers
with rpz-passthru), so every list is still loaded once. The IPv6 part
of a gate leaves the IPv4-mapped range out: named matches IPv4 clients
as ::ffff:a.b.c.d.

Web UI: a Devices panel on the Blocking page and a step on each list.
CLI: jarl block step, jarl block group, jarl blocklist --step. API:
/blocking/steps, /blocking/groups. Database schema 8.

Also: copying the state kept empty lists as empty (not nil), so
reverting a changeset no longer adds restore operations for unchanged
blocklists, rules and views.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -69,6 +69,15 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE "+p+"/blocking/rules", s.authed(s.deleteBlockRulesByName))
 	m.HandleFunc("PATCH "+p+"/blocking/rules/{id}", s.authed(s.updateBlockRule))
 	m.HandleFunc("DELETE "+p+"/blocking/rules/{id}", s.authed(s.deleteBlockRule))
+	m.HandleFunc("GET "+p+"/blocking/steps", s.authed(s.listBlockSteps))
+	m.HandleFunc("POST "+p+"/blocking/steps", s.authed(s.createBlockStep))
+	m.HandleFunc("POST "+p+"/blocking/steps/order", s.authed(s.orderBlockSteps))
+	m.HandleFunc("PATCH "+p+"/blocking/steps/{id}", s.authed(s.updateBlockStep))
+	m.HandleFunc("DELETE "+p+"/blocking/steps/{id}", s.authed(s.deleteBlockStep))
+	m.HandleFunc("GET "+p+"/blocking/groups", s.authed(s.listClientGroups))
+	m.HandleFunc("POST "+p+"/blocking/groups", s.authed(s.createClientGroup))
+	m.HandleFunc("PATCH "+p+"/blocking/groups/{id}", s.authed(s.updateClientGroup))
+	m.HandleFunc("DELETE "+p+"/blocking/groups/{id}", s.authed(s.deleteClientGroup))
 	m.HandleFunc("GET "+p+"/blocking/check", s.authed(s.checkBlocking))
 	m.HandleFunc("GET "+p+"/blocking/status", s.authed(s.blockingStatus))
 	m.HandleFunc("POST "+p+"/blocking/pause", s.authed(s.pauseBlocking(false)))