Zigbee role/recipe catalogs are hardcoded Python, not operator-extensible

zigbee-ux Phase 4. Operator overlay (settings zigbee_custom_roles / zigbee_custom_recipes) merges over the Python base. Custom ROLES are pure routing labels — a climate/safety kind slots into fleet handling. Custom TASKS are datapoint-only (when=None → evaluate_device_policies no-ops; no actuator/banner). Slug-validated, built-ins refused. New ZigbeeCatalogCard on Settings → Device manages them on the SettingsTable primitive. Tests: test_zigbee_policies.test_custom_role_overlay / test_custom_recipe_is_datapoint_only. NOTE: actuator/banner task authoring stays code-defined.