Migrate empty allowed groups from 1.6.x

migrations/20260511085206_[2.0.0]_migrate_location_with_empty_allowed_groups.up.sql

@@ -0,0 +1,9 @@
+-- In 1.6.x an empty allowed groups list meant all groups have access to location.
+-- Restore that meaning for locations that were migrated without any explicit group assigned.
+UPDATE wireguard_network AS location
+SET allow_all_groups = true
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM wireguard_network_allowed_group AS allowed_group
+    WHERE allowed_group.network_id = location.id
+);