feat(firewall): traffic rules editor with visual policy list

[gnacho]

UniFi-style traffic rules editor on native fw4 UCI sections, replacing the old zone-card rule editor:

• Rules with action (ACCEPT/DROP/REJECT), source/destination IP/CIDR, port range, protocol (tcp/udp/any) and schedule using firewall4's real start_time/stop_time/weekdays/utc_time options. No DPI/app categories (stock OpenWrt has none) and no client groups: source/destination are IPs or CIDRs.
• The new Traffic Rules page (connection group, gateway-only) is the only writer of firewall.rule, with named netgrip_fw_N sections; the old zone-based FirewallCard (anonymous sections) is removed and the zone diagram stays as a read-only card inside the new page.
• Lock-out guard: a deny/reject rule whose broad source covers the management network (probe reports mgmt_cidr) with unbounded destination raises a warning before saving.
• Add/delete through the executor with snapshot, firewall reload healthcheck and rollback; delete refuses non-managed sections. The UCI read cache is invalidated after apply/rollback so the healthcheck verifies the fresh state, not the previous one (caught live: without it every add rolled back).
• Probe reports the UCI ruleset with managed/system marking; i18n ES/EN, demo stub, 10 unit tests for the ops planner, validators and lock-out logic.

Live-verified on a lab router: an added rule lands in UCI and is rendered by fw4 into the real nft ruleset; delete cleans both; deleting a system rule is refused.

Closes #444