Add enable/disable toggle for the global firewall allow/block lists

New firewall.DisableGlobal() removes the wireguard_ui_global nftables
table without touching stored IP list entries, and firewall.IsGlobalEnabled()
reports whether it's currently loaded. New GET /firewall-lists/status and
POST /firewall-lists/disable endpoints (admin-only), plus a status badge
and "Toggle enable/disable" button on the Global Firewall Lists page -
one click to turn the whole thing off without losing the list contents,
and back on again (re-applies the current ruleset).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

handler/routes.go

@@ -2004,6 +2004,38 @@ func GetGlobalFirewallPreview(db store.IStore) echo.HandlerFunc {
 	}
 }
 
+// GetGlobalFirewallStatus reports whether the host-wide allow/block list
+// table is currently loaded in the live firewall.
+func GetGlobalFirewallStatus() echo.HandlerFunc {
+	return func(c echo.Context) error {
+		return c.JSON(http.StatusOK, map[string]interface{}{
+			"enabled": firewall.IsGlobalEnabled(),
+		})
+	}
+}
+
+// DisableGlobalFirewallHandler removes the host-wide allow/block list table
+// from the live firewall, without touching the stored entries.
+func DisableGlobalFirewallHandler() echo.HandlerFunc {
+	return func(c echo.Context) error {
+		output, err := firewall.DisableGlobal()
+		if err != nil {
+			log.Errorf("Failed to disable global firewall: %v\n%s", err, output)
+			return c.JSON(http.StatusInternalServerError, map[string]interface{}{
+				"success": false,
+				"message": err.Error(),
+				"output":  output,
+			})
+		}
+		log.Infof("Disabled global firewall allow/block lists")
+		return c.JSON(http.StatusOK, map[string]interface{}{
+			"success": true,
+			"message": "Global firewall disabled",
+			"output":  output,
+		})
+	}
+}
+
 // ApplyGlobalFirewallHandler loads the host-wide allow/block list ruleset
 // live via `nft -f`, scoped to firewall.GlobalTableName only. Runs at
 // priority -10, before every per-server WireGuard firewall table, so it