feat(acls): add HuJSON formatting and validation

[KnowItAllKing]

Summary

• add comment-preserving HuJSON formatting to the raw ACL editor
• show live parse diagnostics and prevent invalid or empty saves
• validate again server-side before sending policies to Headscale
• document the editor behavior and add a Next changelog entry

Testing

• pnpm run test:unit — 260 passed
• pnpm run typecheck
• pnpm run lint
• pnpm run format
• pnpm run build
• manual ACL editor testing

Follow-up to #607 and #608.

[pullfrog]

ℹ️ No blocking issues — two minor observations inline.

Reviewed changes

• Comment-preserving formatting (app/utils/acl-policy.ts) — adds formatPolicy on top of jsonc-parser's format, and rewrites parsePolicy onto parseTree with allowTrailingComma: true. The move off scanHuJson-then-JSON.parse also fixes a latent bug where the trailing-comma regex corrupted ,}/,] sequences inside string values.
• Live diagnostics (cm.client.tsx) — a CodeMirror linter plus a status bar surface validatePolicy errors inline, and a Format button reflows the buffer.
• Save gating (overview.tsx, acl-action.ts) — the Save button disables on empty or invalid policy, and the action re-validates server-side before forwarding to Headscale.
• Docs & changelog — docs/features/acls.md and a # Next changelog entry describe the new editor behavior.
• Tests — unit coverage for formatPolicy, validatePolicy, the string-corruption regression, and the new action guard.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

• Empty-policy neutrality (acl-policy.ts, cm.client.tsx) — validatePolicy no longer reports an empty policy as a syntax error, and the editor shows a neutral "No policy yet" state with a CircleDashed icon instead of a red error on first run. The Format button is disabled while empty.
• Line-preserving formatting (acl-policy.ts) — formatPolicy switched to keepLines: true, so blank-line section groupings and inline arrays survive formatting while indentation and spacing are still normalized.
• Nix hash bump (nix/package.nix) — the dependency hash now matches the jsonc-parser and @codemirror/lint additions from the earlier commit.
• Tests — updated and extended to cover keepLines layout preservation, empty-policy neutrality, and non-formatting of empty input.

  ^{｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) ｜ 𝕏}