Add a generic NAT table: port forward, source NAT, masquerade

router.firewall.nat replaces the dnat/toPort/hairpin fields of the filter
rules. Filter rules gain natOnly, and may use wan with log and rate limit
in the web UI. The Firewall page edits the NAT table and can add the
matching allow rule. Settings schema 1 (migrations/1.jq) converts old
forwards.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/webui.nix

@@ -137,12 +137,12 @@ pkgs.testers.runNixOSTest {
         assert post("/firewall", {"csrf": csrf("/firewall"), **rule}) == "422"
 
     with subtest("a port forward is saved and listed"):
-        fwd = {"forwards": "1", "fwd.0.protocol": "tcp", "fwd.0.ports": "8080", "fwd.0.to": "main",
-               "fwd.0.destination": "192.168.10.5", "fwd.0.nat": "on"}
+        fwd = {"nats": "1", "nat.0.type": "dnat", "nat.0.from": "wan", "nat.0.protocol": "tcp", "nat.0.ports": "8080",
+               "nat.0.to": "main", "nat.0.toaddress": "192.168.10.5", "nat.0.allow": "on"}
         assert post("/firewall", {"csrf": csrf("/firewall"), **fwd}) == "303"
         assert 'value="192.168.10.5"' in curl(f"{ui}/firewall")
         saved = router.succeed(f"cat {cfg}")
-        assert '"dnat": true' in saved and '"from": "wan"' in saved, saved
+        assert '"type": "dnat"' in saved and '"from": "wan"' in saved and '"natOnly": true' in saved, saved
 
     with subtest("dynamic DNS is saved with its secret kept out of the settings"):
         dd = {"enabled": "on", "protocol": "cloudflare", "username": "token", "zone": "example.org",