feat: Groups / target lists (tags first-class)

[ultimaterex]

Summary

• Groups inventory for group/user/device tags with master–detail UI
• Member assign via existing host.group policy path
• Tag CRUD capability-gated off pending lab RE (research has tag:create/remove but no lab fixtures)
• Type-aware View in Devices; hermetic parse/API tests
• Spec: docs/superpowers/specs/2026-08-26-target-lists-design.md

Epic D note

Same host-policy endpoint as DeviceDetail Group select; no duplicate assign API. Groups detail uses POST /v1/fw-app/hosts/policy; DeviceDetail Group select remains (may single-select overwrite multi-tag — known).

Test plan

• Groups filter namespaces; counts match devices
• Detail View in Devices filters by tag type
• Assign/unassign group membership when paired
• CRUD controls disabled when caps off
• go test + ui vitest/build green