Add nftables firewall ruleset preview per server (review-only)

New firewall package generates an nftables snippet (INPUT accept for the
listen port, FORWARD rules for the WireGuard interface, optional LAN
forwarding via a new ServerSetting.LanInterface field). Text only -
nothing is applied to the live firewall. Exposed as GET
/servers/:id/firewall-preview and a "Firewall Preview" button in the
All Servers page.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

model/setting.go

@@ -24,5 +24,10 @@ type ServerSetting struct {
 	FirewallMark    string    `json:"firewall_mark"`
 	Table           string    `json:"table"`
 	ConfigFilePath  string    `json:"config_file_path"`
-	UpdatedAt       time.Time `json:"updated_at"`
+	// LanInterface is optional: the local interface (e.g. "eth0", "br-lan")
+	// this server's WireGuard traffic should be allowed to forward to/from.
+	// Only used to generate the nftables ruleset preview; left empty means
+	// the preview only covers the WireGuard interface itself.
+	LanInterface string    `json:"lan_interface,omitempty"`
+	UpdatedAt    time.Time `json:"updated_at"`
 }