feat: add allowed_subnets for VPN relay/site-to-site configuration

[fherbert]

This adds support to add devices in site to site mode - ie as vpn relays.
Features:

• Extends device SQLModel to include allowed_subnets list
• Adds optional routed subnets (allowed_subnets) field to device configuration (both under user and admin view)

• If device has allowed_subnets configured:
  • The list of subnets will be appended on the server side peer allowed ip config

• Any traffic coming from these subnets will be forwarded to the users chain

• routes will be added to the routing table for each subnet

Happy to discuss this PR and can start conversation from here :-)

[bartei]

This looks great! I was planning on adding something similar already, I'll take a look and test it on my instances as soon as I find some time.

Thank you for the kind contribution, the clean PR and the comprehensive test suite included with it.

[bartei]

Thanks for this, @fherbert — really useful capability, and the implementation was clean and well-tested. 🙌

We've merged your work into main via #4 (merge commit 9a5c09f), which preserves your original commits. A few changes were applied on top during integration:

• Migration rebased onto the current head — your migration branched off b7e2f4a1c903, which would have created two Alembic heads after some unrelated migrations landed and broken alembic upgrade head on startup.
• CIDR validation added (parse_subnet_list): routed subnets are validated + normalized before they reach nft/ip route, which rejects malformed input (prevents one bad entry from failing the whole firewall rebuild, and closes a command-injection vector).
• Scoped to admins: the routed-subnets field was moved off the end-user device page — declaring relays is an admin capability.
• Route reconciliation: building on your add_routes/remove_routes, we added sync_routes so device delete/edit and startup reconcile prune orphaned routes (and preserve subnets still used by other devices), with unit tests for the new paths. Your add_routes/remove_routes tests carried over.
• Dropped the semantic-release version bump + CHANGELOG that rode along on the branch (our release pipeline owns versioning).

Closing this PR since the feature is now in main via #4. Thanks again for the contribution!