fix(firewall): fehlende onError-Handler + i18n in Rules + NATRules

- 6 Mutations (create/update/del je Rules + NATRules) bekommen onError-Handler
- Deutsche Placeholder-Texte → t() überführt
- Action-Labels (accept/drop/reject) und Kind-Labels (any/object/group/cidr)
  in t() überführt statt hardkodiert anzeigen
- CIDR-Label-Hardkodierung in Rules-Formular behoben
- en/de: fw.rule.actions.*, fw.rule.kinds.*, fw.rule.namePlaceholder,
  fw.nat.namePlaceholder ergänzt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/de/common.json

@@ -105,6 +105,10 @@
       "hits": "Hits",
       "add": "Regel hinzufügen", "edit": "Regel bearbeiten",
       "deleteConfirm": "Diese Regel wirklich löschen?",
+      "namePlaceholder": "z.B. SSH von Office erlauben",
+      "cidr": "CIDR",
+      "actions": { "accept": "ACCEPT", "drop": "DROP", "reject": "REJECT" },
+      "kinds": { "any": "Beliebig", "object": "Objekt", "group": "Gruppe", "cidr": "CIDR" },
       "emptyTitle": "Noch keine eigenen Firewall-Regeln.",
       "emptyDesc": "Die System-Regeln oben halten SSH (rate-limited), HTTPS :443 und Mgmt-UI :3443 immer offen (Anti-Lockout). Eigene Regeln für app-spezifische Inbound-Ports oder zonenübergreifende Forwards anlegen."
     },
@@ -119,6 +123,7 @@
       "comment": "Kommentar",
       "add": "NAT-Regel hinzufügen", "edit": "NAT-Regel bearbeiten",
       "deleteConfirm": "Diese NAT-Regel wirklich löschen?",
+      "namePlaceholder": "z.B. HTTP zu Web-Backend weiterleiten",
       "emptyTitle": "Noch keine NAT-Regeln.",
       "emptyDesc": "DNAT (z. B. extern :2030 → intern 10.10.20.12:22 für SSH zu einem internen Host) oder SNAT/MASQUERADE (Internet-Zugang für ein internes Subnetz über die Box-IP)."
     },

management-ui/src/i18n/locales/en/common.json

@@ -105,6 +105,10 @@
       "hits": "Hits",
       "add": "Add rule", "edit": "Edit rule",
       "deleteConfirm": "Really delete this rule?",
+      "namePlaceholder": "e.g. Allow SSH from office",
+      "cidr": "CIDR",
+      "actions": { "accept": "ACCEPT", "drop": "DROP", "reject": "REJECT" },
+      "kinds": { "any": "Any", "object": "Object", "group": "Group", "cidr": "CIDR" },
       "emptyTitle": "No custom firewall rules yet.",
       "emptyDesc": "The system rules above keep SSH (rate-limited), HTTPS :443 and the mgmt UI :3443 open (anti-lockout). Add custom rules for app-specific inbound ports or cross-zone forwards."
     },
@@ -119,6 +123,7 @@
       "comment": "Comment",
       "add": "Add NAT rule", "edit": "Edit NAT rule",
       "deleteConfirm": "Really delete this NAT rule?",
+      "namePlaceholder": "e.g. Forward HTTP to web backend",
       "emptyTitle": "No NAT rules yet.",
       "emptyDesc": "DNAT (e.g. external :2030 → internal 10.10.20.12:22 for SSH to an internal host) or SNAT/MASQUERADE (internet access for an internal subnet via the box IP)."
     },