Add per-server NAT egress, ip_forward auto-enable, OPNsense import review checklist

- ServerSetting gains WanInterface/EgressSNATIP for optional per-server
  masquerade/SNAT of client traffic, isolated in each server's own
  nftables table
- wireguard.Start/Restart now ensure net.ipv4.ip_forward and
  net.ipv6.conf.all.forwarding are enabled before bringing an interface up
- OPNsense config.xml import now parses staticroutes/filter/nat rules and
  surfaces them as a manual-review checklist in the preview UI (never
  auto-applied)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATVUwTa4Pqwq26orW5BcDW

model/setting.go

@@ -29,6 +29,16 @@ type ServerSetting struct {
 	// Only used to generate the nftables ruleset preview; left empty means
 	// the preview only covers the WireGuard interface itself.
 	LanInterface string `json:"lan_interface,omitempty"`
+	// WanInterface is optional: the local interface this server's client
+	// traffic should be masqueraded/SNATed out through for full-tunnel
+	// (internet-egress) clients, e.g. "eth0". Leave empty to skip NAT
+	// entirely (site-to-site only, no internet egress via this server).
+	WanInterface string `json:"wan_interface,omitempty"`
+	// EgressSNATIP is optional: pins the source address used when NATing
+	// this server's client traffic out WanInterface, for hosts with
+	// multiple public IPs on the same interface. Leave empty to use
+	// plain masquerade (follow the interface's routed address).
+	EgressSNATIP string `json:"egress_snat_ip,omitempty"`
 	// DNSServers and MTU are optional per-server overrides of the app-wide
 	// GlobalSetting.DNSServers/GlobalSetting.MTU. Leave empty/zero to fall
 	// back to the global default (see handler.buildEffectiveSettings).