Project Snapshot v1 into a deterministic access graph #7

Parent: #2

Build one bounded foundation slice for the visual permissions map: convert an already-normalized Snapshot v1 into a deterministic typed graph.

Acceptance criteria

• Add a small package (for example internal/accessgraph) that validates a snapshot.Snapshot and returns typed nodes, typed edges, and a sorted list of incomplete source sections.
• Emit nodes for networks, firewall zones, adopted devices, active clients, Wi-Fi broadcasts, firewall policies, and ACL rules.
• Emit only relationships backed by existing snapshot references: zone-to-network, device/client/Wi-Fi-to-network, client-to-device when present, policy-to-source/destination zone, ACL-to-network, and policy-to-ACL from policy references.
• Never invent an edge when an allowed partial/unavailable section leaves a target missing.
• Sort nodes and edges deterministically so identical snapshots produce byte-for-byte stable projections.
• Add focused tests for the complete and degraded synthetic fixtures, deterministic ordering, and missing-target omission.
• Briefly document the graph projection in README.

Scope boundaries

No controller HTTP, credentials, live topology, UI, persistence, or controller mutation. Do not broaden the snapshot schema unless a test proves it is necessary for this projection.

Required checks

• gofmt
• go test ./...
• go vet ./...
• go build ./...