Console: return [] for an empty group list, and fix its deployment manifest

GET /api/clients returned "groups": null when there were no groups, because the
merged list was a nil slice. Found against the real cluster.

The console manifest, never applied before, had an image name that does not
exist here, no image pull secret or architecture selector (the resolver's pods
have both), and pointed at a Service (fancy-dns-admin) that is not there. It
now uses the registry image, the pull secret, and the existing fancy-dns-web
Service.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/app/console_e2e_test.go

@@ -104,7 +104,11 @@ func TestConsoleEditsReachTheResolver(t *testing.T) {
 	// A group the console just removed disappears from its own view at once.
 	ok("PUT", "/api/clients", `{"groups":[]}`)
 	view = clients{}
-	if err := json.Unmarshal([]byte(ok("GET", "/api/clients", "")), &view); err != nil || len(view.Groups) != 0 {
+	raw := ok("GET", "/api/clients", "")
+	if !strings.Contains(raw, `"groups":[]`) {
+		t.Errorf("an empty group list must be [] and not null: %s", raw)
+	}
+	if err := json.Unmarshal([]byte(raw), &view); err != nil || len(view.Groups) != 0 {
 		t.Fatalf("clients after delete = %+v (%v)", view, err)
 	}
 	eventually(t, "the resolver to drop the deleted group", func() bool {

internal/console/hooks.go

@@ -179,7 +179,8 @@ func (c *Console) handleClients(w http.ResponseWriter, r *http.Request) {
 		inCluster[o.Name] = o
 	}
 	groups, _ := view["groups"].([]any)
-	var merged []any
+	// Never nil: an empty list must be [] on the wire, not null.
+	merged := []any{}
 	seen := map[string]bool{}
 	for _, g := range groups {
 		m, _ := g.(map[string]any)