refactor code, new db tables, show AP info on UI

frontend/README.md

@@ -1,8 +1,9 @@
 # radui — RADIUS Admin Portal
 
-Web UI for the [`radapi`](../radapi) FreeRADIUS REST API. Manage **devices** and
-**VLANs** without touching SQL. Auth is an **API key** entered on a login screen and
-stored in the browser (`localStorage`), sent as `X-API-Key` on every request.
+Web UI for the [`radapi`](../radapi) FreeRADIUS REST API. Manage **clients**
+(customer MACs), **devices** (NAS/AP boxes seen in accounting), and **VLANs**
+without touching SQL. Auth is an **API key** entered on a login screen and stored in
+the browser (`localStorage`), sent as `X-API-Key` on every request.
 
 ## Stack
 
@@ -55,19 +56,28 @@ src/
   main.tsx            providers (router, auth, toaster)
   App.tsx             auth gate + nav + routes
   auth/auth.tsx       API-key auth context (login/logout, 401 handling)
-  lib/api.ts          typed API client (device + vlan) + error handling
+  lib/api.ts          typed API client (client + device + vlan) + error handling
   lib/utils.ts        cn() helper
   pages/
     Login.tsx         API-key login screen
-    Devices.tsx       device list + add/edit/delete dialogs
+    Clients.tsx       client list + add/edit/delete + CSV import/export dialogs
+    Devices.tsx       NAS device list + editable alias
     Vlans.tsx         VLAN list + add/rename/delete dialogs
-  components/ui/       button, input, label, dialog, select, table, card, badge, sonner
+  components/
+    ClientImportExport.tsx   CSV import (preview/confirm) + export dialog
+    ui/                      button, input, label, dialog, select, table, card, badge, sonner
 ```
 
 ## Notes
 
-- **Add device** requires MAC, group (VLAN), name, phone; alias optional. The group
-  dropdown is populated from `GET /vlan/`.
-- **Edit device** can change group, status, name, phone, alias (any subset).
+- **Clients** — add requires MAC, group (VLAN), name, phone; alias optional. The
+  group dropdown is populated from `GET /vlan/`. Edit changes any subset of group,
+  status, name, phone, alias.
+- **CSV import** parses the file client-side, does a dry-run against
+  `POST /client/import` to preview valid/error rows, and only writes on confirm.
+  Export downloads all clients as CSV.
+- **Devices** — lists NAS/AP boxes from accounting, one row per **AP MAC** (with its
+  NAS IP and all SSIDs — extra SSIDs collapse to `SSID1 (and N more…)` on hover). The
+  only editable field is the human `alias` (`PUT /device/{ap_mac}`).
 - Validation/`4xx` errors from the API surface as toasts with the server's message
   (422 field errors are flattened to `field: message`).