Show and change a device's blocking from its Insights panel

[drudge]

Before: a device's Insights panel shows what it is and what it queries, but nothing about blocking. Putting a device in a rule set means editing [[clients]], and there's no way to cut a device off for a while.

After: the panel has a Blocking section. It names the rule set the device uses and what put it there (its hardware address, an address, a network, or Bypass Clients). A pencil opens a picker to give the device a rule set of its own or fall back to what it inherits, and the inherited choice says where it comes from, like "Guests (from the network 10.20.40.0/24)". Block Everything blocks the device for 30 minutes, an hour, until a time, or until turned off. While held, the panel shows when it ends with a live countdown, plus Add 30 Minutes and End Now. A hold that comes from a network says so, and ending it ends it for that network.

Part of #240 (PR 4b). Changes need blocking.write; viewers without it see the section read-only.

How: dnsserver.MatchClient runs the DNS server's own client table (exact address, then MAC, then most specific network, bypass first) so the panel always agrees with DNS. config.SetClientRuleSet reuses the name/type editor path, so a MAC entry takes over the device's exact-address entries. ruleSetService.Assign writes and audits the change (blocking.rule_set.assign/unassign) and refuses unknown rule sets; holds go through the existing holdService. New routes are POST /ui/insights/devices/rule-set and /hold. The countdown is a small [data-countdown-until] ticker in app.js that refreshes the panel when the hold ends.

Screenshots

Before shots are from main. The editor and hold states are new, so they have after shots only.

	Before	After
Device panel
Device panel, dark
Rule set picker
Rule set picker, dark
Block Everything form
Block Everything form, dark
Held, with countdown
Held, with countdown, dark

Phone

	Before	After
Device panel
Device panel, dark
Rule set picker
Rule set picker, dark
Block Everything form
Block Everything form, dark
Held, with countdown
Held, with countdown, dark

Testing

go tool mage verify passes. New tests cover the panel's rule set picker (including permissions and an unknown set), bypassed devices, holds (start, extend, end, until turned off, bad times), network holds, holdUntil, timeLeft, config.SetClientRuleSet, and dnsserver.MatchClient.