fix: preserve rule order in diff and insert replacements in place

internal/nftables/engine.go

@@ -109,12 +109,18 @@ func (e *Engine) Apply(changes *ChangeSet) error {
 		if !ok {
 			return fmt.Errorf("unknown chain %q", r.Chain)
 		}
-		e.conn.AddRule(&nftables.Rule{
+		rule := &nftables.Rule{
 			Table:    table,
 			Chain:    chain,
 			Exprs:    r.Exprs,
 			UserData: []byte(r.Tag),
-		})
+		}
+		if r.Before != 0 {
+			rule.Position = r.Before
+			e.conn.InsertRule(rule)
+		} else {
+			e.conn.AddRule(rule)
+		}
 	}
 
 	return e.conn.Flush()