When a .list is moved between groups whose `gateway` files differ
in metric semantics (e.g., failover→multipath), the previous code
only deleted state and kept the table.  This caused stale routes
with the old `metric N` to coexist with newly loaded multipath
routes, because `ip route replace` keyed on dst+metric and treated
them as distinct entries.

Two related changes:
- cleanup_state's "moved" branch now flushes the table before the
  new group loads it, so the table starts clean.
- cleanup_state is invoked before process_routes so the flushes
  happen prior to the new group's load (otherwise a flush after
  load would wipe out the just-installed routes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>