Serve a master key's devices from several servers

A master key now has a set of servers (the panel's own and/or nodes). A
device's single WireGuard key becomes a peer on every server of its key,
each with its own IP and PSK, and config.servers[] lists them all.

- ui.db: master_servers (the key's set, never empty), device_peers (which
  key is on which server, with the ip/psk that server issued),
  peer_tombstones (peers to delete) and server_profiles (last known
  profile of each server).
- Nothing is pushed blindly: reconcile() brings one server to the desired
  state - deletes tombstones, adds peers, rekeys with PUT, fills ip/psk,
  rotates a pending PSK - one pass per server at a time. It runs right
  after every action, when a node connects and once a minute, so a node
  that was offline catches up on rekeys, PSK changes and removals.
- config is built from ui.db, so an offline node stays in it and rev does
  not flap; a server is listed once its peer carries the device's current
  key. An empty config is never sent (502 instead); register and rekey
  roll back if no server accepted the key.
- Existing keys and devices migrate on start. With one server the config
  and its rev are byte-identical to 0.3.1 (checked by running both
  versions on the same ui.db), so existing clients notice nothing.
- Panel: server checkboxes in the key settings instead of the placeholder
  (the last one cannot be removed), "на N из M серверов" on devices that
  have not reached every server yet, device stats summed over servers.
- SUB_HOST: the panel's public address for sen:// links and endpoints;
  install.sh writes it. Without it a panel with no VPN of its own used
  the address it was opened at.
- A node referenced by a key's server set cannot be deleted.

awg-ui/src/tabs/masterkeys/masterkeys.css

@@ -162,13 +162,11 @@ LICENSE file in the root directory of this source tree.
 .mk-server-name { font-weight: 500; }
 .mk-server-ip, .mk-server-gen { font-size: 12px; color: var(--neutral-text); }
 .mk-server-ip { font-family: var(--mono); margin-left: auto; }
-.mk-server-add {
-    width: 100%; justify-content: center;
-    background: transparent;
-    border: 1px dashed var(--outline);
-    color: var(--neutral-dot);
-    cursor: not-allowed;
-}
+.mk-server { cursor: pointer; }
+.mk-server:hover { background: var(--state-primary); }
+.mk-server--locked { cursor: default; }
+.mk-server--locked:hover { background: var(--surface-container); }
+.mk-server-dot { padding: 0; background: none; }
 .mk-box .tip-wrap { width: 100%; }
 
 /* дети: вертикальная линия слева и «ножка» к каждому узлу */