Add SQLite persistence and write-through gRPC mutations

Database (internal/db) stores listeners, routes, and firewall rules with
WAL mode, foreign keys, and idempotent migrations. First run seeds from
TOML config; subsequent runs load from DB as source of truth.

gRPC admin API now writes to the database before updating in-memory state
(write-through cache pattern). Adds snapshot command for VACUUM INTO
backups. Refactors firewall.New to accept raw rule slices instead of
config struct for flexibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/db/migrations.go

@@ -0,0 +1,93 @@
+package db
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+type migration struct {
+	version int
+	name    string
+	fn      func(tx *sql.Tx) error
+}
+
+var migrations = []migration{
+	{1, "create_core_tables", migrate001CreateCoreTables},
+}
+
+// Migrate runs all unapplied migrations sequentially.
+func (s *Store) Migrate() error {
+	// Ensure the migration tracking table exists.
+	_, err := s.db.Exec(`
+		CREATE TABLE IF NOT EXISTS schema_migrations (
+			version INTEGER PRIMARY KEY,
+			applied TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+		)
+	`)
+	if err != nil {
+		return fmt.Errorf("creating schema_migrations table: %w", err)
+	}
+
+	var current int
+	err = s.db.QueryRow("SELECT COALESCE(MAX(version), 0) FROM schema_migrations").Scan(&current)
+	if err != nil {
+		return fmt.Errorf("querying current migration version: %w", err)
+	}
+
+	for _, m := range migrations {
+		if m.version <= current {
+			continue
+		}
+
+		tx, err := s.db.Begin()
+		if err != nil {
+			return fmt.Errorf("beginning migration %d (%s): %w", m.version, m.name, err)
+		}
+
+		if err := m.fn(tx); err != nil {
+			tx.Rollback()
+			return fmt.Errorf("running migration %d (%s): %w", m.version, m.name, err)
+		}
+
+		if _, err := tx.Exec("INSERT INTO schema_migrations (version) VALUES (?)", m.version); err != nil {
+			tx.Rollback()
+			return fmt.Errorf("recording migration %d (%s): %w", m.version, m.name, err)
+		}
+
+		if err := tx.Commit(); err != nil {
+			return fmt.Errorf("committing migration %d (%s): %w", m.version, m.name, err)
+		}
+	}
+
+	return nil
+}
+
+func migrate001CreateCoreTables(tx *sql.Tx) error {
+	stmts := []string{
+		`CREATE TABLE IF NOT EXISTS listeners (
+			id   INTEGER PRIMARY KEY,
+			addr TEXT NOT NULL UNIQUE
+		)`,
+		`CREATE TABLE IF NOT EXISTS routes (
+			id          INTEGER PRIMARY KEY,
+			listener_id INTEGER NOT NULL REFERENCES listeners(id) ON DELETE CASCADE,
+			hostname    TEXT NOT NULL,
+			backend     TEXT NOT NULL,
+			UNIQUE(listener_id, hostname)
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_routes_listener ON routes(listener_id)`,
+		`CREATE TABLE IF NOT EXISTS firewall_rules (
+			id    INTEGER PRIMARY KEY,
+			type  TEXT NOT NULL CHECK(type IN ('ip', 'cidr', 'country')),
+			value TEXT NOT NULL,
+			UNIQUE(type, value)
+		)`,
+	}
+
+	for _, stmt := range stmts {
+		if _, err := tx.Exec(stmt); err != nil {
+			return err
+		}
+	}
+	return nil
+}