Add comprehensive nftables compiler with shorewall feature parity

Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall
firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone,
blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections,
DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions,
MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type
matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT,
and policy-level rate/conn limiting.

Adds full config types for all shorewall subsystems (mangle, accounting, maclist,
netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks),
shorewall migration tooling, expanded CLI commands, expression-level diff engine,
and 49 unit tests.

internal/nftables/diff.go

@@ -64,7 +64,13 @@ func computeDiff(current, desired *FirewallState) *ChangeSet {
 	}
 
 	for tag, desiredRules := range desiredByTag {
-		if _, exists := currentByTag[tag]; !exists {
+		currentRules, exists := currentByTag[tag]
+		if !exists {
+			cs.Add = append(cs.Add, desiredRules...)
+			continue
+		}
+		if !rulesMatch(currentRules, desiredRules) {
+			cs.Remove = append(cs.Remove, currentRules...)
 			cs.Add = append(cs.Add, desiredRules...)
 		}
 	}
@@ -77,3 +83,27 @@ func computeDiff(current, desired *FirewallState) *ChangeSet {
 
 	return cs
 }
+
+func rulesMatch(a, b []ManagedRule) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i].Chain != b[i].Chain {
+			return false
+		}
+		if !exprsEqual(a[i].Exprs, b[i].Exprs) {
+			return false
+		}
+	}
+	return true
+}
+
+func exprsEqual(a, b []expr.Any) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	as := fmt.Sprintf("%v", a)
+	bs := fmt.Sprintf("%v", b)
+	return as == bs
+}