Fix search, virtual bulk actions, refresh jobs, and CI

[yellowman]

Repairs the search regression and the related large-fleet/UI issues found during review.

Search and navigation

• Dashboard/device header search only advertises matches the current scope/status filters can actually reveal.
• Inventory matches hidden by filters are reported as hidden instead of becoming dead navigation results.
• Search rebuilds/expands the host tree, centers and highlights the matched host, and restores the independent sidebar filter when cleared.
• Virtual-table search renders the target buffer immediately before highlighting, removing the scroll/render race.
• Map search now pans to the matching device marker and opens its popup.

Virtualized bulk actions

• Bulk selection is persistent application state instead of checked DOM nodes, so scrolling or live row updates no longer silently drop selected devices.
• Checkbox state is restored whenever regular or virtual rows are rebuilt.
• Selection is pruned when inventory records disappear and cleared on navigation/cancel/delete.
• The existing Bulk Configure button is now wired to the existing modal and API.

Batch configuration safety

• Validates request size, device count, supported fields, and field values server-side.
• Rejects unknown request/config fields.
• Changelog records only changed field names, never values/passwords.
• Password changes are encrypted and persisted after the device accepts the new credential, preventing WaveControl from losing access after its own password change.
• Successful targets are refreshed after a UI-driven batch apply.

Refresh jobs

• Async and scheduled refresh jobs now call the real poller via RefreshDeviceByID instead of reporting fake success.
• Per-device queue failures are recorded and reflected in final job status/progress.

Regression guardrail

• Adds GitHub Actions CI for every PR and main push:
  • go test ./...
  • go build ./cmd/server
  • syntax-check all first-party frontend JS modules

Validation

CI run 35403912423 is green on head 5d76c97:

• Go tests: passed
• Server build: passed
• JavaScript syntax: passed

The branch is mergeable against main.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e17235fb-99c1-4112-b14f-087bffa07300)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3be1d4e3-484c-41a8-8e33-52fc77e2a560)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_00086c7e-9e01-4b6e-b63f-4a95f10f8b69)