v0.4.3: feat(reports): report DynamicGuard leases and per-connection access logs

The panel publishes each entry node's address pool but never learns which
address inside it a client holds, so it cannot answer "who was 10.8.0.2 at
09:40". The device table already knows, so the push task now sends the whole
table as a snapshot on every tick. An empty snapshot is sent too: that is how
a node says it released everything, and skipping it would leave the panel
showing addresses that are gone.

Access logging stays off unless the panel sets access_log_enabled in
base_config. A DynamicGuard node observes flows in the ACL hook, which is the
only place a decapsulated packet exists; the flow table is bounded and
deduplicates on a five-minute TTL, so a long session costs one record rather
than one per packet, and the write path keeps its allocation-free shape while
logging is off. A SATLS node records at the dispatcher's existing access
message, after sniffing, so the destination is the name the sniffer resolved.
It deliberately does not install a log.Handler: xray keeps a single global one
and ours would replace the operator's own access log.

Both endpoints are additive, so a panel that does not implement them answers
404. The first 404 latches that endpoint off for the client, which lives until
the next reload; without it a DynamicGuard node would post a lease snapshot at
a route that will never exist on every tick, forever. Any other status is
ignored exactly like the traffic and alive reports ignore theirs: these are
observations, and losing one must never stall the push carrying the counters
that bill.