Add SQLite persistence and write-through gRPC mutations

Database (internal/db) stores listeners, routes, and firewall rules with
WAL mode, foreign keys, and idempotent migrations. First run seeds from
TOML config; subsequent runs load from DB as source of truth.

gRPC admin API now writes to the database before updating in-memory state
(write-through cache pattern). Adds snapshot command for VACUUM INTO
backups. Refactors firewall.New to accept raw rule slices instead of
config struct for flexibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mc-proxy.toml.example

@@ -1,6 +1,13 @@
 # mc-proxy configuration
 
+# Database. Required. Listeners, routes, and firewall rules are persisted here.
+# On first run, the database is seeded from the config below.
+# On subsequent runs, the database is the source of truth.
+[database]
+path = "/srv/mc-proxy/mc-proxy.db"
+
 # Listeners. Each listener binds a TCP port and has its own route table.
+# These are used to seed the database on first run only.
 [[listeners]]
 addr = ":443"