feat(dpi): refactor DPI section

[m-dilorenzi]

This PR contains a rework on the DPI rule management around application groups and an ordered, first-match-wins rule list, replacing the old flat schema where every rule was a device plus a list of applications or protocols, all evaluated in parallel.

Main changes

• Application groups as a new reusable entity, referenced by rules instead of inlining applications and protocols in each one.
• Rules now carry a name, an action, an optional source and a priority, and halt on match, so their order decides the outcome. Two actions: block and the new allow.
• API: rule CRUD is id-based and gains rename, enable, disable and reorder, plus the application group CRUD. Catalog lookups are split between what the engine has loaded and the downloaded catalogs. Removed list-popular, list-devices and the global exemption CRUD, replaced by an Allow rule at the top of the list.
• Migration: a uci-defaults script converts /etc/config/dpi on the first boot after the upgrade. Legacy rules are kept with their behaviour frozen verbatim, global exemptions become Allow rules, unsupported rules are dropped with a log line naming them.
• Generator: dpi-config orders the actions by priority, refuses to emit a rule that would produce an invalid criteria, and still handles the old schema for a box whose migration has not run yet.