Work to add RT-BE92U to the supported devices.

What v2.7.6 carries over v2.7.5 (canon c793b26229 + f1faad50c6, bump 71a4fd46ca; rt-be92u 598d814177 + 5b1fe5cf4c, bump 23bb050c54):

• Policy Routing apply.sh now builds its object ipsets itself on every apply, so a reboot can no longer leave the mangle chain short until a UI Apply; failed rules are named in syslog.
• 40-domain object pastes: tolerant normaliser, persistent error naming every offender, no silent truncation; plus the rfw_obj_set buffer bug that made a ≥768-byte object's firewall rules match nothing.
• Warden page shows "Stats unavailable – retrying" instead of dead placeholders; stats.sh waits 2 s not 5.
• All Reaper layer re-applies after restart_firewall run under the firewall lock (firewall-start addon hooks are fire-and-forget).
• PBR teardown deletes only ip rules carrying our fwmark — an addon's rules (domain_vpn_routing) survive.
• Metal owed: reboot → full REAPER_PBR chain with no Apply; a 40-domain paste saving in one go; Warden page under load; an addon ip rule in 9001–9115 surviving restart_firewall.