eBPF host firewall + Cilium-model egress gateway

[GyulyVGC]

eBPF host firewall

• Default-deny TC classifier on the uplink NIC (ingress + egress), stateful via a connection-tracking map.
• Explicit per-direction/protocol port allowlist; ARP and ICMP always allowed; gRPC-to-server and VXLAN/forward (4789/9999) to known peers permitted.
• Removes the old rule-based nullnet-firewall crate and its integration.
• Auto-detects the uplink NIC from the default route — no more manual ETH_NAME.

Egress gateway (Cilium model)

• Registered service → internet via kernel forwarding (ip_forward + MASQUERADE), no userspace proxy.
• First packet held until the flow is steered (deliver-original, like backend triggers).
• Egress edges reaped on container death.
• Topology graph shows egress edges, with an egress-aware EdgePanel in the UI.