Manage, not view: persistence (Save), rule edit and move

[edimarlnx]

The nftables backend built rules, NAT and aliases but everything was runtime-only and immutable: a reboot reverted the ruleset to whatever the router profile rendered, and the only way to change a rule was delete-and-re-add. This PR closes the three gaps.

Save (W) — persistence

• Captures the tool's own table with nft list table inet tui and installs it with install -m 644 /dev/stdin <path>. The listing rides on stdin, never on a command line, and nft's own text is a valid nft script, so nft -f loads the file straight back on boot.
• Path: /etc/omarchy/router/tui-firewall.nft on an Omarchy router (the profile includes it on boot — the profile hook lands separately), /etc/nftables.d/tui-firewall.nft on any other host, TUI_FIREWALL_SAVE_PATH override for tests and labs.
• The confirm dialog shows the install command plus a unified diff against the file as it stands (new UnifiedDiff helper); a file that already matches is reported without opening a dialog.
• install(1) gets a lazily-built runner of its own inside internal/nftables, dispatched per command, so the exec boundary is unchanged (check-exec.sh clean).

Edit in place (E)

• The add-rule form opens pre-filled from the rule's modelled Match (new SpecForRule) and submits as nft replace rule … handle H, reusing the log toggle's rebuild machinery — same handle, same position.
• Same refusals as BuildToggleLog, made shared in checkRebuildable: a rule with an unmodeled match, a NAT rule, a non-accept/drop/reject verdict, plus edit-specific refusals for source-port matches, log levels / nflog groups, empty-verdict rules and reject-with answers the form cannot round-trip. Refused before the form opens, with the reason.

Move (K/J)

• nftables has no move, so a move is a copy at the new position plus a delete of the old handle — and the two always apply as one nft -f transaction: staged into the atomic batch when staging is on, wrapped by the new staging.AtomicCommand when it is off. The confirm shows the whole transaction script.
• First/last positions are refused; the rebuilt copy keeps the rule's own log statement, prefix included.

Deliberately left out

Per-rule enable/disable needs a persisted-spec format (v2); DESIGN.md records the approach instead of shipping a fake disable that drops rules.

Evidence

• go build, go vet, gofmt, make check-exec: clean.
• go test ./...: all green. New coverage: exact-argv builder tests, injection guards on every edited operand, refusal paths (unmodeled/NAT/sport/log-args/first/last/position-on-edit), save path guards and env override, diff rendering, demo parity (fake applies edit, atomic move and pretends the install; --demo never touches disk), and UI tests for the W/E/K/J flows including staged-move and non-nftables refusals.
• README updated in the same PR (keys table, a "Manage, not view" section, can/cannot lists).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MCypLQF5AD8JD831Ea9S9q