[Feat]: Group policies for reusable client routing, DNS, and firewall settings

Description

This request is related to, but different from, visual peer grouping and labeling in #2437.

WG-Easy already supports global defaults and per-client settings for client AllowedIPs, DNS servers, and server-side firewall rules. In installations with several classes of users, the same combinations of settings often need to be repeated across many clients—for example customers, staff, administrators, and third-party users.

Currently, administrators must configure these settings client by client. This makes changes repetitive, increases the risk of configuration drift, and makes it harder to audit whether clients with the same intended access are configured consistently.

Client AllowedIPs should remain routing configuration only. They control which traffic the client sends through the tunnel, but they are not a security boundary because users can modify their local WireGuard configuration.

Actual access control should continue to be enforced independently by WG-Easy’s existing server-side firewall subsystem.

Server-side firewall changes can apply immediately when saved. Changes to DNS or client AllowedIPs, however, affect the generated client configuration. Existing installed configurations will not update automatically, so WG-Easy should indicate when affected clients need to download and import a regenerated configuration.

Based on the current implementation, effective firewall destinations appear to use the following fallback:

Explicit client firewall settings
-> client AllowedIPs
-> global defaultAllowedIps

This is convenient, but it also allows routing settings to influence server-side firewall enforcement when no explicit firewall policy is configured.

Related work:

• #2437: visual peer grouping / client labeling
• #1625: access lists and groups
• #2418: existing per-client firewall filtering
• #2631: expansion of per-client firewall behavior
• #1927: inherited versus copied DNS and AllowedIPs

Suggested Solution

Introduce an optional reusable policy or group layer between global defaults and per-client overrides:

Global defaults -> Policy/Group -> Client override

A policy/group could provide inherited values for settings WG-Easy already supports per client:

• client AllowedIPs
• DNS servers
• existing server-side firewall rules using the current destination, port, and protocol syntax

Clients should still be able to override inherited values where appropriate.

This should build on the existing per-client firewall feature introduced in #2418. It should not require a new firewall language or create a parallel firewall implementation.

Existing clients with no assigned policy/group should keep their current behavior. The feature should remain optional for users who only need global defaults and per-client overrides.

Questions for maintainers:

1. Should this concept be called groups, policies, or profiles?
2. Should a client have one policy or support multiple policies?
3. Should client overrides replace inherited values or merge with them?
4. With policies, should the existing firewall fallback be preserved, made explicit/configurable, or avoided in favor of explicit firewall policy?

Alternatives

No response

Additional Context

No response