feat: Replace SQM with per-client speed control for paid WiFi upgrade

Add parahub-speed-control script (nftables set + tc HTB) for per-IP
speed shaping. Free tier 512kbps, paid tier unlimited. Heartbeat now
parses paid_clients from API response and syncs nftables set.

Replaced sqm-scripts/kmod-sched-cake/luci-app-sqm packages with
tc-full/kmod-ifb/kmod-sched-htb. Section 8 of uci-defaults creates
init.d service for speed control instead of SQM config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/usr/bin/parahub-heartbeat

@@ -34,26 +34,38 @@ esac
 
 PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"25.12.0-rc4\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\"}"
 
+RESPONSE=""
+
 if [ "$ROLE" = "bee" ]; then
     # Bee: no yggdrasil, use public URL only
-    curl -s -m 10 -X POST \
+    RESPONSE=$(curl -s -m 10 -X POST \
         -H "Content-Type: application/json" \
         -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
         -d "$PAYLOAD" \
-        "${PARAHUB_API_PUBLIC}" >/dev/null 2>&1
+        "${PARAHUB_API_PUBLIC}" 2>/dev/null)
 else
     # Bumblebee: try yggdrasil first, fallback to public
     if ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then
-        curl -s -m 10 -X POST \
+        RESPONSE=$(curl -s -m 10 -X POST \
             -H "Content-Type: application/json" \
             -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
             -d "$PAYLOAD" \
-            "${PARAHUB_API_YGG}" >/dev/null 2>&1
+            "${PARAHUB_API_YGG}" 2>/dev/null)
     else
-        curl -s -m 10 -X POST \
+        RESPONSE=$(curl -s -m 10 -X POST \
             -H "Content-Type: application/json" \
             -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
             -d "$PAYLOAD" \
-            "${PARAHUB_API_PUBLIC}" >/dev/null 2>&1
+            "${PARAHUB_API_PUBLIC}" 2>/dev/null)
     fi
 fi
+
+# Sync paid_clients to speed control (Bumblebee only)
+if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPONSE" ]; then
+    PAID_IPS=$(echo "$RESPONSE" | jsonfilter -e '$.paid_clients[*]' 2>/dev/null)
+    # Flush and re-add all paid IPs
+    parahub-speed-control flush
+    for IP in $PAID_IPS; do
+        parahub-speed-control add "$IP"
+    done
+fi