Add a firewall page to the web UI

Allow rules between zones (LANs and tunnels) are edited on their own page:
from, to, protocol, ports, destination. Port forwards and rules with more
options are listed and kept as they are.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/webui.nix

@@ -131,6 +131,11 @@ pkgs.testers.runNixOSTest {
         assert post("/network", fields) == "303"
         assert "printer" in router.succeed(f"cat {cfg}")
 
+    with subtest("the firewall page lists the zones and refuses a rule to an unknown one"):
+        assert 'value="main"' in curl(f"{ui}/firewall")
+        rule = {"rows": "1", "rule.0.from": "main", "rule.0.to": "nowhere", "rule.0.protocol": "any"}
+        assert post("/firewall", {"csrf": csrf("/firewall"), **rule}) == "422"
+
     with subtest("the web UI hands out a backup of the router's state"):
         curl(f"-sf -d csrf={csrf('/advanced')} -o /tmp/backup.tar.gz {ui}/backup")
         files = client.succeed("tar -tzf /tmp/backup.tar.gz")