Add per-server NAT egress, ip_forward auto-enable, OPNsense import review checklist

- ServerSetting gains WanInterface/EgressSNATIP for optional per-server
  masquerade/SNAT of client traffic, isolated in each server's own
  nftables table
- wireguard.Start/Restart now ensure net.ipv4.ip_forward and
  net.ipv6.conf.all.forwarding are enabled before bringing an interface up
- OPNsense config.xml import now parses staticroutes/filter/nat rules and
  surfaces them as a manual-review checklist in the preview UI (never
  auto-applied)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATVUwTa4Pqwq26orW5BcDW

firewall/nftables.go

@@ -90,6 +90,18 @@ func GenerateRuleset(server model.Server, settings model.ServerSetting, rules []
 		fmt.Fprintf(&b, "%s\n", line)
 	}
 	fmt.Fprintf(&b, "    }\n")
+
+	if settings.WanInterface != "" {
+		fmt.Fprintf(&b, "\n    chain postrouting {\n")
+		fmt.Fprintf(&b, "        type nat hook postrouting priority 100; policy accept;\n")
+		if settings.EgressSNATIP != "" {
+			fmt.Fprintf(&b, "        iifname \"%s\" oifname \"%s\" snat to %s comment \"wg-ui-multi: %s egress\"\n", ifaceName, settings.WanInterface, settings.EgressSNATIP, server.ID)
+		} else {
+			fmt.Fprintf(&b, "        iifname \"%s\" oifname \"%s\" masquerade comment \"wg-ui-multi: %s egress\"\n", ifaceName, settings.WanInterface, server.ID)
+		}
+		fmt.Fprintf(&b, "    }\n")
+	}
+
 	fmt.Fprintf(&b, "}\n")
 
 	return b.String()