Added client isolation settings. Fixed mobile UI

README.md

@@ -60,10 +60,13 @@ The database stores all client data needed to restore configs:
 - assigned IPv4 address
 - public key
 - private key
+- optional owner-scoped connectivity group
 - enabled flag
 - created/updated timestamps
 
-The Kubernetes Secret is derived from the database. Active clients are rendered into one configured Secret key, `peers.conf` by default.
+The Kubernetes Secret is derived from the database. Active clients are rendered
+into `peers.conf`; exact same-owner/same-group IPv4 pairs are rendered into
+`policy.conf`. Clients without a group are isolated from other VPN clients.
 
 ## Kubernetes Sync
 
@@ -169,6 +172,7 @@ The JSON API is session-authenticated unless noted:
 - `POST /api/telegram-link/unlink`
 - `POST /api/vpn-clients`
 - `POST /api/vpn-clients/{id}/enabled`
+- `POST /api/vpn-clients/{id}/group` changes the group and rotates the client key pair
 - `DELETE /api/vpn-clients/{id}`
 - `GET /api/vpn-clients/{id}/config` returns `servers[]` with one raw AWG config and one Amnezia `vpn://` import link per registered endpoint
 - `POST /api/vpn-clients/sync`