Add SQLite persistence and write-through gRPC mutations

Database (internal/db) stores listeners, routes, and firewall rules with
WAL mode, foreign keys, and idempotent migrations. First run seeds from
TOML config; subsequent runs load from DB as source of truth.

gRPC admin API now writes to the database before updating in-memory state
(write-through cache pattern). Adds snapshot command for VACUUM INTO
backups. Refactors firewall.New to accept raw rule slices instead of
config struct for flexibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/db/routes.go

@@ -0,0 +1,61 @@
+package db
+
+import "fmt"
+
+// Route is a database route record.
+type Route struct {
+	ID         int64
+	ListenerID int64
+	Hostname   string
+	Backend    string
+}
+
+// ListRoutes returns all routes for a listener.
+func (s *Store) ListRoutes(listenerID int64) ([]Route, error) {
+	rows, err := s.db.Query(
+		"SELECT id, listener_id, hostname, backend FROM routes WHERE listener_id = ? ORDER BY hostname",
+		listenerID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("querying routes: %w", err)
+	}
+	defer rows.Close()
+
+	var routes []Route
+	for rows.Next() {
+		var r Route
+		if err := rows.Scan(&r.ID, &r.ListenerID, &r.Hostname, &r.Backend); err != nil {
+			return nil, fmt.Errorf("scanning route: %w", err)
+		}
+		routes = append(routes, r)
+	}
+	return routes, rows.Err()
+}
+
+// CreateRoute inserts a route and returns its ID.
+func (s *Store) CreateRoute(listenerID int64, hostname, backend string) (int64, error) {
+	result, err := s.db.Exec(
+		"INSERT INTO routes (listener_id, hostname, backend) VALUES (?, ?, ?)",
+		listenerID, hostname, backend,
+	)
+	if err != nil {
+		return 0, fmt.Errorf("inserting route: %w", err)
+	}
+	return result.LastInsertId()
+}
+
+// DeleteRoute deletes a route by listener ID and hostname.
+func (s *Store) DeleteRoute(listenerID int64, hostname string) error {
+	result, err := s.db.Exec(
+		"DELETE FROM routes WHERE listener_id = ? AND hostname = ?",
+		listenerID, hostname,
+	)
+	if err != nil {
+		return fmt.Errorf("deleting route: %w", err)
+	}
+	n, _ := result.RowsAffected()
+	if n == 0 {
+		return fmt.Errorf("route %q not found on listener %d", hostname, listenerID)
+	}
+	return nil
+}