Edit port forwards and openings from the internet on the firewall page

Rules from wan are edited in their own table: protocol, ports, zone, host,
host port, allowed sources, port forward (NAT), hairpin, log and rate
limit, with the module's checks done up front.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/webui.nix

@@ -136,6 +136,14 @@ pkgs.testers.runNixOSTest {
         rule = {"rows": "1", "rule.0.from": "main", "rule.0.to": "nowhere", "rule.0.protocol": "any"}
         assert post("/firewall", {"csrf": csrf("/firewall"), **rule}) == "422"
 
+    with subtest("a port forward is saved and listed"):
+        fwd = {"forwards": "1", "fwd.0.protocol": "tcp", "fwd.0.ports": "8080", "fwd.0.to": "main",
+               "fwd.0.destination": "192.168.10.5", "fwd.0.nat": "on"}
+        assert post("/firewall", {"csrf": csrf("/firewall"), **fwd}) == "303"
+        assert 'value="192.168.10.5"' in curl(f"{ui}/firewall")
+        saved = router.succeed(f"cat {cfg}")
+        assert '"dnat": true' in saved and '"from": "wan"' in saved, saved
+
     with subtest("the web UI hands out a backup of the router's state"):
         curl(f"-sf -d csrf={csrf('/advanced')} -o /tmp/backup.tar.gz {ui}/backup")
         files = client.succeed("tar -tzf /tmp/backup.tar.gz")