refactor: replace array-based expressions with typed class hierarchy

Replace the old Lisp-like array expression representation
(["AND", ["PARAM", ...], ...]) with a class hierarchy rooted in
an abstract Expression class (Literal, Parameter, Binary, Unary,
FunctionCall, Conditional). This gives compile-time type safety
to expression construction, evaluation, and pattern matching.

Key changes:
- New lib/common/expression.ts defines the class hierarchy with
  map/evaluate/toString methods
- Rewrite parser as hand-rolled recursive descent, removing the
  parsimmon dependency
- Extend Path with a colon separator to unify parameter identity
  and attributes into a single address space (e.g.
  "Device.WiFi.SSID.1.Name:writable"). The colon field tracks
  how many trailing segments are attribute qualifiers. PathSet
  rewritten with separate param/attr segment indexes
- Flatten device attribute representation in the UI to
  colon-delimited keys mirroring the new path syntax

ui/permissions-page.ts

@@ -1,6 +1,6 @@
 import { Children, ClosureComponent, Component } from "mithril";
 import { m } from "./components.ts";
-import config from "./config.ts";
+import { pageSize as PAGE_SIZE } from "./config.ts";
 import * as store from "./store.ts";
 import * as notifications from "./notifications.ts";
 import memoize from "../lib/common/memoize.ts";
@@ -8,12 +8,10 @@ import putFormComponent from "./put-form-component.ts";
 import indexTableComponent from "./index-table-component.ts";
 import * as overlay from "./overlay.ts";
 import * as smartQuery from "./smart-query.ts";
-import { map, parse, stringify } from "../lib/common/expression/parser.ts";
+import Expression from "../lib/common/expression.ts";
 import filterComponent from "./filter-component.ts";
 
-const PAGE_SIZE = config.ui.pageSize || 10;
-
-const memoizedParse = memoize(parse);
+const memoizedParse = memoize((str) => Expression.parse(str));
 const memoizedJsonParse = memoize(JSON.parse);
 
 const attributes = [
@@ -60,10 +58,22 @@ function getExcerpt(text: string, maxLength = 80, maxLines = 10): string[] {
   return lines;
 }
 
-const unpackSmartQuery = memoize((query) => {
-  return map(query, (e) => {
-    if (Array.isArray(e) && e[0] === "FUNC" && e[1] === "Q")
-      return smartQuery.unpack("permissions", e[2], e[3]);
+const unpackSmartQuery = memoize((query: Expression) => {
+  return query.evaluate((e) => {
+    if (e instanceof Expression.FunctionCall) {
+      if (e.name === "Q") {
+        if (
+          e.args[0] instanceof Expression.Literal &&
+          e.args[1] instanceof Expression.Literal
+        ) {
+          return smartQuery.unpack(
+            "permissions",
+            e.args[0].value as string,
+            e.args[1].value as string,
+          );
+        }
+      }
+    }
     return e;
   });
 });
@@ -89,7 +99,7 @@ function putActionHandler(action, _object, isNew): Promise<ValidationErrors> {
 
       if (object.filter) {
         try {
-          object.filter = stringify(memoizedParse(object.filter));
+          object.filter = memoizedParse(object.filter).toString();
         } catch {
           return void resolve({
             filter: "Filter must be valid expression",
@@ -99,7 +109,7 @@ function putActionHandler(action, _object, isNew): Promise<ValidationErrors> {
 
       if (object.validate) {
         try {
-          object.validate = stringify(memoizedParse(object.validate));
+          object.validate = memoizedParse(object.validate).toString();
         } catch {
           return void resolve({
             validate: "Validate must be valid expression",
@@ -163,7 +173,7 @@ const getDownloadUrl = memoize((filter) => {
   const cols = {};
   for (const attr of attributes) cols[attr.label] = attr.id;
   return `api/permissions.csv?${m.buildQueryString({
-    filter: stringify(filter),
+    filter: filter.toString(),
     columns: JSON.stringify(cols),
   })}`;
 });
@@ -176,8 +186,11 @@ export function init(
       new Error("You are not authorized to view this page"),
     );
   }
-  const sort = args.hasOwnProperty("sort") ? "" + args["sort"] : "";
-  const filter = args.hasOwnProperty("filter") ? "" + args["filter"] : "";
+  let filter: Expression = null;
+  let sort: Record<string, number> = null;
+  if (args.hasOwnProperty("filter"))
+    filter = Expression.parse(args["filter"] as string);
+  if (args.hasOwnProperty("sort")) sort = JSON.parse(args["sort"] as string);
   return Promise.resolve({ filter, sort });
 }
 
@@ -193,7 +206,9 @@ export const component: ClosureComponent = (): Component => {
       }
 
       function onFilterChanged(filter): void {
-        const ops = { filter };
+        const ops = {};
+        if (!(filter instanceof Expression.Literal && filter.value))
+          ops["filter"] = filter.toString();
         if (vnode.attrs["sort"]) ops["sort"] = vnode.attrs["sort"];
         m.route.set("/permissions", ops);
       }
@@ -218,10 +233,9 @@ export const component: ClosureComponent = (): Component => {
         m.route.set("/permissions", ops);
       }
 
-      let filter = vnode.attrs["filter"]
-        ? memoizedParse(vnode.attrs["filter"])
-        : true;
-      filter = unpackSmartQuery(filter);
+      const filter = unpackSmartQuery(
+        vnode.attrs["filter"] ?? new Expression.Literal(true),
+      );
 
       const permissions = store.fetch("permissions", filter, {
         limit: vnode.state["showCount"] || PAGE_SIZE,