Add tomswall agent (control-plane pull mode)

Add `tomswall agent`: it pulls this device's compiled config from tomswallapi,
differentially applies it, and reports the applied generation. It caches the
last known-good config and, when the control plane is unreachable, keeps
applying that cache — it never fails closed.

- internal/agent: rendered-config types, HTTP client (fetch + status report),
  on-disk cache, on-device DNS resolver for dns sets (honors the device's
  configured resolver, fail-safe on lookup failure), and the pull-apply-report
  loop behind a mockable Applier.
- Translate the interface-agnostic, address-matched rendered model into native
  tomswall config using the "all:<cidr>" any-interface source/dest form, reusing
  the existing differential engine. Named-set members are inlined as concrete
  addresses (native nft set references are a tracked follow-up).
- cmd/tomswall: wire the `agent` subcommand (flags + TOMSWALL_* env, --once).
- Unit tests: translation, cache, and the don't-fail-closed fallback loop.
- Add DESIGN.md documenting the control-plane architecture.

internal/nftables/compiler.go

@@ -1126,19 +1126,19 @@ func matchTCPFlagsDrop(iface string) []expr.Any {
 }
 
 var icmpTypeNames = map[string]byte{
-	"echo-reply":               0,
-	"destination-unreachable":  3,
-	"source-quench":            4,
-	"redirect":                 5,
-	"echo-request":             8,
-	"router-advertisement":     9,
-	"router-solicitation":      10,
-	"time-exceeded":            11,
-	"parameter-problem":        12,
-	"timestamp-request":        13,
-	"timestamp-reply":          14,
-	"address-mask-request":     17,
-	"address-mask-reply":       18,
+	"echo-reply":              0,
+	"destination-unreachable": 3,
+	"source-quench":           4,
+	"redirect":                5,
+	"echo-request":            8,
+	"router-advertisement":    9,
+	"router-solicitation":     10,
+	"time-exceeded":           11,
+	"parameter-problem":       12,
+	"timestamp-request":       13,
+	"timestamp-reply":         14,
+	"address-mask-request":    17,
+	"address-mask-reply":      18,
 }
 
 func matchICMPType(spec string) []expr.Any {
@@ -1589,7 +1589,7 @@ func buildLog(level, prefix string) []expr.Any {
 	}
 	return []expr.Any{
 		&expr.Log{
-			Key:   1 << unix.NFTA_LOG_PREFIX | 1<<unix.NFTA_LOG_LEVEL,
+			Key:   1<<unix.NFTA_LOG_PREFIX | 1<<unix.NFTA_LOG_LEVEL,
 			Level: nfLevel,
 			Data:  []byte(logPrefix),
 		},

internal/nftables/compiler_test.go

@@ -915,9 +915,9 @@ func TestCompile_RateLimit(t *testing.T) {
 			{
 				Action:    config.RuleAccept,
 				Source:    "net",
-				Dest:     "fw",
-				Proto:    "tcp",
-				DPort:    config.PortSpec{"22"},
+				Dest:      "fw",
+				Proto:     "tcp",
+				DPort:     config.PortSpec{"22"},
 				RateLimit: "10/sec:5",
 			},
 		},
@@ -1353,9 +1353,9 @@ func TestCompile_ConnLimit(t *testing.T) {
 			{
 				Action:    config.RuleAccept,
 				Source:    "net",
-				Dest:     "fw",
-				Proto:    "tcp",
-				DPort:    config.PortSpec{"22"},
+				Dest:      "fw",
+				Proto:     "tcp",
+				DPort:     config.PortSpec{"22"},
 				ConnLimit: "20",
 			},
 		},