Add live firewall rule management per server (nftables)

New model.FirewallRule + jsondb CRUD (GetFirewallRules/CreateFirewallRule/
UpdateFirewallRule/DeleteFirewallRule), scoped per server. firewall package
now generates a full ruleset (baseline + enabled custom rules) and can
apply it live via `nft -f` (firewall.Apply), scoped to a per-server
nftables table (wireguard_ui_<serverID>) so applying one server never
touches another server's rules or any pre-existing firewall state.

New endpoints: GET/POST /servers/:id/firewall/rules, POST .../rules/:ruleId,
POST .../rules/:ruleId/delete, POST .../apply (live, admin-only). UI in the
All Servers page: rule table with add/delete, ruleset preview, and an
"Apply now (live)" button with an explicit confirm() warning before it
touches the running firewall.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

model/firewall.go

@@ -0,0 +1,21 @@
+package model
+
+import "time"
+
+// FirewallRule is a single user-defined nftables rule scoped to one server.
+// Rules are combined with the server's baseline (listen-port accept +
+// WireGuard-interface forwarding) to build the full ruleset that gets
+// applied via `nft -f`.
+type FirewallRule struct {
+	ID        string    `json:"id"`
+	ServerID  string    `json:"server_id"`
+	Direction string    `json:"direction"` // "input" or "forward"
+	Protocol  string    `json:"protocol"`  // "tcp", "udp", or "" (any)
+	Port      string    `json:"port"`      // e.g. "8080" or "8000-9000", "" = any
+	Source    string    `json:"source"`    // optional CIDR, "" = any
+	Action    string    `json:"action"`    // "accept", "drop", or "reject"
+	Comment   string    `json:"comment"`
+	Enabled   bool      `json:"enabled"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}