restrictions: family-time wizard fixes (inline groups, weekly-range scheduling)

[ispyisail]

Summary

Three real gaps found using the Family Time Controls wizard (#147):

1. The "no groups yet" message told a parent to go to "Known Devices" — that name appears nowhere in the actual UI (the real nav label is Connection > DHCP). Now offers to create a group inline instead (device picker + group name), reusing the same charset rule and device_N section shape dhcp.js already uses, and only falls back to a message when there is truly nothing to pick from — which now correctly names the real page.
2. The wizard used active_weekdays + active_hours, which match weekday and time-of-day independently at every moment with no concept of one session spanning two calendar days. A midnight-crossing window (e.g. 21:00-07:00) needed BOTH the start day and end day checked for the crossing to close out, but checking the end day also opened a second, unwanted partial block starting that day's own evening, silently cut off at midnight since the day after wasn't checked too. Switched to active_weekly_ranges: one explicit Day HH:MM - Day HH:MM piece per selected day on a continuous Sunday-to-Saturday clock, including the Saturday-into-Sunday week wrap, with no such artifact — matches the general Restrictions form's own weekly-schedule field format exactly.
3. The From/To fields are 24-hour only but nothing said so. Added an explicit hint plus a live "(9:00 PM)" preview next to each field as it's typed, and a note that times use the router's own time zone, not the browser's — relevant when configuring remotely while traveling.

Depends on #155 for the scheduling fix to actually take effect — active_weekly_ranges rules (both this wizard's and the general form's own pre-existing option) currently fail to load into nftables at all due to a separate, unrelated bug in gargoyle-firewall-util. This PR's own logic is correct and independently reviewable regardless of merge order, but the schedule won't actually enforce anything until #155 lands too.

Test plan

• Full jsdom restrictions test suite: 53/53 passed
• vnet phase 53 (rewritten): real browser end-to-end — inline group creation, midnight-crossing per-day rolling, multi-group same-day scheduling, validation reject. All 4 checks pass against a live 3-site simulator.