Add comprehensive nftables compiler with shorewall feature parity

Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall
firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone,
blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections,
DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions,
MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type
matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT,
and policy-level rate/conn limiting.

Adds full config types for all shorewall subsystems (mangle, accounting, maclist,
netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks),
shorewall migration tooling, expanded CLI commands, expression-level diff engine,
and 49 unit tests.

scripts/test-migration.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+set -euo pipefail
+
+TOMSWALL="$(dirname "$0")/../tomswall"
+TMPDIR="$(mktemp -d /tmp/tomswall-test.XXXXXX)"
+trap "rm -rf $TMPDIR" EXIT
+
+echo "=== tomswall migration test ==="
+echo "Temp directory: $TMPDIR"
+echo
+
+# Step 1: Save current iptables state
+echo "--- Step 1: Saving current iptables/nftables state ---"
+if command -v iptables-save &>/dev/null; then
+    iptables-save > "$TMPDIR/iptables-current.txt" 2>/dev/null || true
+fi
+if command -v nft &>/dev/null; then
+    nft list ruleset > "$TMPDIR/nft-current.txt" 2>/dev/null || true
+fi
+echo "Saved to $TMPDIR/iptables-current.txt and $TMPDIR/nft-current.txt"
+echo
+
+# Step 2: Migrate shorewall config to YAML
+echo "--- Step 2: Migrating /etc/shorewall to YAML ---"
+"$TOMSWALL" migrate /etc/shorewall -o "$TMPDIR/migrated.yaml" 2>&1
+echo "Migrated config written to $TMPDIR/migrated.yaml"
+echo
+
+# Step 3: Also output JSON for comparison
+echo "--- Step 3: Migrating /etc/shorewall to JSON ---"
+"$TOMSWALL" migrate /etc/shorewall -f json -o "$TMPDIR/migrated.json" 2>&1
+echo "JSON config written to $TMPDIR/migrated.json"
+echo
+
+# Step 4: Validate the migrated config
+echo "--- Step 4: Validating migrated YAML config ---"
+"$TOMSWALL" validate -c "$TMPDIR/migrated.yaml" 2>&1 || true
+echo
+
+# Step 5: Validate reading from shorewall directory directly
+echo "--- Step 5: Validating shorewall directory directly ---"
+"$TOMSWALL" validate -c /etc/shorewall 2>&1 || true
+echo
+
+# Step 6: Plan against migrated config (shows what tomswall would do)
+echo "--- Step 6: Planning changes from migrated config ---"
+"$TOMSWALL" plan -c "$TMPDIR/migrated.yaml" 2>&1 || true
+echo
+
+# Step 7: Plan against shorewall directory
+echo "--- Step 7: Planning changes from shorewall directory ---"
+"$TOMSWALL" plan -c /etc/shorewall 2>&1 || true
+echo
+
+# Step 8: Show the migrated YAML
+echo "--- Step 8: Migrated YAML (first 100 lines) ---"
+head -100 "$TMPDIR/migrated.yaml"
+echo
+echo "..."
+echo
+
+echo "=== Test complete ==="
+echo "Files saved in $TMPDIR:"
+ls -la "$TMPDIR/"
+echo
+echo "To keep files, copy from: $TMPDIR"
+echo "(Directory will be cleaned up on script exit)"
+echo
+echo "Press Enter to clean up, or Ctrl-C to keep files."
+read -r