feat(ui): filters on the clients, devices and events tables (v0.23.9-beta)

Closes #99, #100, #107, #108.

Four reports with one root complaint: the tables sort but do not filter, which is
fine at four devices and painful at forty.

#100 / #99 — clients
  VLAN and signal-range filters, both server-side so counts and pagination stay
  correct across the whole dataset rather than the page in hand. Filter state lives
  in the URL alongside the existing wired/wireless choice, which makes a filtered
  view shareable and gives the AP Deployment Density chart somewhere to point.

  Clicking a density bubble now opens the clients list filtered to wireless clients
  in that signal zone (#99). The zone, not the 2 dB drawing bin — the bin is a
  rendering detail and the zone is the question being asked. Verified against the
  fleet: the four zones partition all 17 wireless clients exactly.

  VLAN options are built from VLANs actually present, so the list never offers a
  choice that returns nothing.

  Category filtering is deliberately absent. The effective category is a user
  override where set and otherwise a fingerprint computed in JS from vendor and
  hostname, so there is no column to filter on, and filtering after pagination would
  report wrong totals. Persisting the fingerprint would fix it and is noted in the
  route, along with the cost: a stored value goes stale whenever the rules change.

#107 — devices
  Rack and location selectors, populated from what is actually recorded so neither
  offers an empty choice. Free-text search now also covers location, rack and slot,
  so "datacenter" or "rack-4" finds devices without touching a dropdown. A RACK
  column joins the table, sortable like the rest.

#108 — events
  RouterOS reports topics as a comma-separated list, so the useful unit of filtering
  is the token rather than the string. A new endpoint splits and counts them across
  the whole table — not merely the loaded page — and the free-text topic box becomes
  a populated selector.

  Topic filtering also changed from ILIKE '%token%' to exact array membership. The
  badges present topics as discrete tags, so `error` must not quietly also match a
  hypothetical `no-error`.

On this fleet the endpoint reports 537,346 `info`, 535,439 `system` and 535,362
`account` — which makes the reporter's aside about login noise dominating the events
table concretely true, and worth its own issue.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/components/wireless/RfHealth.tsx

@@ -1,5 +1,6 @@
 import { useState } from 'react';
 import { useQuery } from '@tanstack/react-query';
+import { useNavigate } from 'react-router-dom';
 import { Radio, Signal, Activity, ShieldCheck, AlertTriangle } from 'lucide-react';
 import clsx from 'clsx';
 import { wirelessApi } from '../../services/api';
@@ -173,6 +174,7 @@ const RSSI_MAX = -30;
 const RSSI_TICKS = [-90, -80, -70, -60, -50, -40, -30];
 
 export function RssiDensity({ deviceId }: { deviceId?: number }) {
+  const navigate = useNavigate();
   const { data: signals = [] } = useQuery({
     queryKey: ['rf-signals', deviceId],
     queryFn: () => wirelessApi.getClientSignals(deviceId).then(r => r.data),
@@ -231,13 +233,23 @@ export function RssiDensity({ deviceId }: { deviceId?: number }) {
             {/* client bubbles */}
             {Array.from(bins.entries()).map(([bin, rows]) => {
               const size = Math.min(34, 12 + (rows.length - 1) * 4);
+              // Clicking a bubble opens the Clients page filtered to wireless clients
+              // in the signal zone that bubble sits in (#99). The zone rather than the
+              // 2 dB bin, because the bin is a drawing detail and the zone is the thing
+              // an operator is actually asking about.
+              const zone = RSSI_ZONES.find(z => bin >= z.min && bin < z.max) ?? RSSI_ZONES[0];
               return (
-                <div key={bin}
-                  title={rows.map(r => `${r.custom_name || r.hostname || r.mac_address} (${r.signal_strength} dBm, ${r.device_name})`).join('\n')}
-                  className="absolute top-1/2 -translate-x-1/2 -translate-y-1/2 rounded-full flex items-center justify-center text-[10px] font-semibold text-white shadow ring-2 ring-white dark:ring-slate-800"
+                <button key={bin}
+                  onClick={() => navigate(`/clients?type=wireless&smin=${zone.min}&smax=${zone.max}`)}
+                  title={[
+                    ...rows.map(r => `${r.custom_name || r.hostname || r.mac_address} (${r.signal_strength} dBm, ${r.device_name})`),
+                    '',
+                    `Click to list ${zone.label.toLowerCase()}-signal clients`,
+                  ].join('\n')}
+                  className="absolute top-1/2 -translate-x-1/2 -translate-y-1/2 rounded-full flex items-center justify-center text-[10px] font-semibold text-white shadow ring-2 ring-white dark:ring-slate-800 hover:ring-blue-400 transition-shadow cursor-pointer"
                   style={{ left: `${pos(bin)}%`, width: size, height: size, backgroundColor: rssiColor(bin) }}>
                   {rows.length > 1 ? rows.length : ''}
-                </div>
+                </button>
               );
             })}
           </div>