Add live firewall rule management per server (nftables)

New model.FirewallRule + jsondb CRUD (GetFirewallRules/CreateFirewallRule/
UpdateFirewallRule/DeleteFirewallRule), scoped per server. firewall package
now generates a full ruleset (baseline + enabled custom rules) and can
apply it live via `nft -f` (firewall.Apply), scoped to a per-server
nftables table (wireguard_ui_<serverID>) so applying one server never
touches another server's rules or any pre-existing firewall state.

New endpoints: GET/POST /servers/:id/firewall/rules, POST .../rules/:ruleId,
POST .../rules/:ruleId/delete, POST .../apply (live, admin-only). UI in the
All Servers page: rule table with add/delete, ruleset preview, and an
"Apply now (live)" button with an explicit confirm() warning before it
touches the running firewall.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

store/store.go

@@ -34,4 +34,8 @@ type IStore interface {
 	SaveServerHashes(serverID string, hashes model.ClientServerHashes) error
 	UpdateServerInterface(serverID string, serverInterface model.ServerInterface) error
 	UpdateServerKeyPair(serverID string, serverKeyPair model.ServerKeypair) error
+	GetFirewallRules(serverID string) ([]model.FirewallRule, error)
+	CreateFirewallRule(rule model.FirewallRule) error
+	UpdateFirewallRule(rule model.FirewallRule) error
+	DeleteFirewallRule(serverID, ruleID string) error
 }