Add enable/disable toggle for the global firewall allow/block lists

New firewall.DisableGlobal() removes the wireguard_ui_global nftables
table without touching stored IP list entries, and firewall.IsGlobalEnabled()
reports whether it's currently loaded. New GET /firewall-lists/status and
POST /firewall-lists/disable endpoints (admin-only), plus a status badge
and "Toggle enable/disable" button on the Global Firewall Lists page -
one click to turn the whole thing off without losing the list contents,
and back on again (re-applies the current ruleset).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

firewall/apply.go

@@ -52,3 +52,23 @@ func Apply(serverID, ruleset string) (string, error) {
 func ApplyGlobal(ruleset string) (string, error) {
 	return applyTable(GlobalTableName, ruleset)
 }
+
+// DisableGlobal removes the host-wide allow/block list table entirely,
+// turning enforcement off without touching the stored IP list entries -
+// they stay in the database and can be re-applied later with ApplyGlobal.
+// A missing table (already disabled) is not treated as an error.
+func DisableGlobal() (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	out, _ := exec.CommandContext(ctx, "nft", "delete", "table", "inet", GlobalTableName).CombinedOutput()
+	return string(out), nil
+}
+
+// IsGlobalEnabled reports whether the host-wide allow/block list table is
+// currently loaded in the live firewall.
+func IsGlobalEnabled() bool {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	err := exec.CommandContext(ctx, "nft", "list", "table", "inet", GlobalTableName).Run()
+	return err == nil
+}