config,web: per-light override with last-command-wins arbitration

[bennotk]

Part of LightWitch M1 — see the rework plan, "Command arbitration". This issue covers the local mechanics only; the mesh message and the button action build on it (separate issues).

Problem

A light can only render its group's state — there is no way to command a single light ("turn green", "blink for 2 s, then return") without changing the whole group. Wanted rule: the newest command owns the light — a direct command overrides the group state; the next actual group change takes the light back.

Proposed change

• Per-light override slot: full LightConfig snapshot (replace, never merge) + baseSeq (the group's seq at capture time) + optional durationMs.
• Arbitration:
  • group re-broadcasts with seq == baseSeq (periodic self-heal) do not displace the override
  • any group update with seq > baseSeq drops the override — the light rejoins its group
  • a newer direct command replaces the previous override
  • durationMs expiry (receiver-side) drops the override
• Override is volatile across reboot. The standing brightness adjustment (brightnessOverrideEnabled, config: allow brightness override per light, not just per group #299) stays untouched — it applies while following the group; an active override bypasses it.
• REST on the owning device: set/clear override for a local light (also the test surface for the mock server).
• Web UI: per-light indicator "following group / overridden" + clear control; override state pushed over WebSocket.

Acceptance criteria

• Setting an override changes exactly that light; all group siblings keep the group scene.
• Group scene change (real seq bump) returns the overridden light to the group.
• Periodic group re-advertisement does not clear an override.
• A durationMs override reverts on its own; reboot clears any override.

Checklist obligations

• Mock parity: REST routes + WS override-state event in server/index.js, mock data with a second group
• /validate-ui on the dashboard indicator/clear flow