known-devices: add Device Groups management (add/edit/delete, multi-group)

[ispyisail]

Summary

• A group was always purely implicit — just a name string repeated on each device's group= field — so there was no way to declare one before assigning a device to it, rename one across every device that carried it, or delete one without editing devices by hand. A device could also only ever belong to one group at a time.
• known_devices.sh gains a config group section type (declared, persists at zero devices) and multi-value list group membership. get_all_groups() unions device-derived names with declared ones. get_device_groups() reads via uci show rather than uci get: a list option with multiple values renders as one space-separated, individually-quoted line there, not one line per value — verified live on real hardware, not assumed.
• post_lease.sh now loops every group a matched MAC belongs to instead of stopping at the first, so a multi-group device's lease events update all of its nftables sets. manage_groups.sh needed no changes — traced the ifup_firewall() call order and confirmed nftables set creation already precedes rule insertion regardless of device count.
• New Devices-page panel: add a group (name only, works with zero devices), edit (renames it on every device carrying it, or just the declaration if zero-device), delete (clears the group from affected devices after confirming the count, never deletes the devices). The Add/Edit Device modal gets a checkbox per existing group (real multi-select) plus a separate add-new field; a name that matches an existing group by case or whitespace joins that group instead of creating a near-duplicate.
• Also folds five copies of an identical knownDeviceGroups shell one-liner (restriction.sh, dhcp.sh, quotas.sh, qos_upload.sh, qos_download.sh) into calls to the one shared library function they were all reimplementing.

Test plan

• Full jsdom test suite: 612 passed (known-devices: 107/107)
• Verified live on real hardware (GL-MT6000): declared a zero-device group, confirmed manage_groups.sh creates its set before any rule can reference it, confirmed cleanup removes it; a device in two groups correctly seeded into both nftables sets and kept correct on live add/del post_lease.sh events
• vnet phase 64 (new): add/edit/delete + multi-group membership end to end, all 4 checks pass