fix(dashboard): nftables-Status aus Kernel statt Systemd-Unit

Vorher: Service-Health-Grid hat 'nftables.service' per systemctl
abgefragt. Distro-Unit ist disabled (wir laden via 'nft -f' aus
dem Renderer) → Dashboard zeigte FW als 'inactive', obwohl Pakete
sehr wohl gefiltert werden.

Fix: Special-case in /system/services für unit='nftables'. Status
= existiert 'table inet edgeguard' im Kernel-Ruleset (sudo nft list
tables). 'kernel-loaded' wenn ja, 'no-table' wenn nein.

Plus: sudoers im postinst erweitert um 'nft list tables' + 'nft list
table inet edgeguard'.

Version 1.0.44.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/handlers/system.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"bufio"
+	stdcontext "context"
 	"log/slog"
 	"net"
 	"net/http"
@@ -67,8 +68,21 @@ func (h *SystemHandler) Services(c *gin.Context) {
 	out := make([]serviceStatus, 0, len(servicesToCheck))
 	for _, s := range servicesToCheck {
 		st := serviceStatus{Label: s.Label, Unit: s.Unit}
-		// systemctl show -p SubState,ActiveEnterTimestamp gives us
-		// state + since in one shot, faster than two calls.
+		if s.Unit == "nftables" {
+			// Distro-Unit nftables.service ist disabled — wir laden
+			// die Rules direkt via 'nft -f' aus dem Renderer. Status
+			// = ist unsere 'inet edgeguard'-Tabelle im Kernel?
+			loaded, when := nftablesKernelState(c.Request.Context())
+			st.Active = loaded
+			if loaded {
+				st.State = "kernel-loaded"
+			} else {
+				st.State = "no-table"
+			}
+			st.Since = when
+			out = append(out, st)
+			continue
+		}
 		raw, err := exec.CommandContext(c.Request.Context(),
 			"systemctl", "show", "-p", "ActiveState,ActiveEnterTimestamp",
 			s.Unit).Output()
@@ -90,6 +104,24 @@ func (h *SystemHandler) Services(c *gin.Context) {
 	response.OK(c, gin.H{"services": out})
 }
 
+// nftablesKernelState reports whether our 'inet edgeguard' table is
+// present in the kernel ruleset. Errors swallow to false. Returns
+// the mtime of the source file as 'since' when loaded.
+func nftablesKernelState(ctx stdcontext.Context) (bool, string) {
+	out, err := exec.CommandContext(ctx, "sudo", "-n", "/usr/sbin/nft", "list", "tables").Output()
+	if err != nil {
+		return false, ""
+	}
+	if !strings.Contains(string(out), "inet edgeguard") {
+		return false, ""
+	}
+	when := ""
+	if fi, err := os.Stat("/etc/edgeguard/nftables.d/ruleset.nft"); err == nil {
+		when = fi.ModTime().UTC().Format(time.RFC3339)
+	}
+	return true, when
+}
+
 type resources struct {
 	LoadAvg1     float64 `json:"load_avg_1"`
 	LoadAvg5     float64 `json:"load_avg_5"`