feat: readable firewall rule expressions

[Jamkris]

Summary

The Firewall page showed each rule's body as raw nftables JSON, which is unreadable. This renders it in nft-like syntax instead.

• New pure services/nftexpr.py render_expr() — converts the JSON statement list to text (e.g. tcp dport 22 accept, ip saddr @allowlist accept, ct state in { established, related } accept). Defensive: unknown shapes fall back to compact JSON, never raises.
• Firewall rules table shows the readable form; the original JSON is on hover (title).
• Section headers tidied (Chains / Sets / Rules).

Test plan

• python -m pytest -q → 137 passed. New: tests/test_nftexpr.py (12 cases incl. UFW/zapret-style rules).

Follow-up

Will validate against a real nft -j list ruleset dump and add a fixture if any rule renders oddly.

---

Summary by cubic

Render firewall rules in readable nft syntax instead of raw JSON to make the Firewall page easier to scan. Handles implicit set membership and meta-key formatting with safe fallbacks.

• New Features
  • Added services/nftexpr.py with render_expr() to convert nftables JSON to nft-like text; supports implicit set membership and correct meta-key prefixes; unknown shapes fall back to compact JSON; names iptables-nft xt matches.
  • Firewall page shows readable rule expressions with the original JSON in the title tooltip; updated headers and code.rule-expr styling/hover.
  • Exposed nft_expr as a template global; added tests for UFW/iptables-nft rules, meta keys, set membership, and fallback cases.

^{Written for commit eaf3d5a. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>