feat(firewall): nftables hit-counter pro Regel + Live-Hits-Spalte in der UI

- ruleset.nft.tpl: operator-rules bekommen `counter <action> comment "egid:<id>"`
  → nft zählt Packets + Bytes per Regel ab dem letzten Ruleset-Apply
- handlers/firewall_counters.go: GET /firewall/counters parst
  `sudo nft list table inet edgeguard` per Regex, liefert [{rule_id,packets,bytes}]
- handlers/firewall_counters_test.go: unit-tests für parseNFTCounters
- Firewall/Rules.tsx: neue "Hits"-Spalte (Packet-Count, Tooltip mit Bytes),
  10s-Polling via TanStack Query ['fw','counters']
- i18n de+en: fw.rule.hits

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/en/common.json

@@ -101,6 +101,7 @@
       "object": "Address object", "group": "Address group",
       "serviceKind": "Service kind", "serviceGroup": "Service group",
       "comment": "Comment",
+      "hits": "Hits",
       "add": "Add rule", "edit": "Edit rule",
       "deleteConfirm": "Really delete this rule?",
       "emptyTitle": "No custom firewall rules yet.",