feat: migrate policy firewall from iptables/ipset to nftables

- Rewrite wg-policy-lib.sh: replace ipset functions with nft helpers, add backup_nftables()
- Rewrite wg-policy-engine.sh: generate nft ruleset file, atomic load via nft -f, rollback support
- Simplify wg-policy-cleanup.sh: single nft delete table inet wg_policy
- Update wg-policy-ctl: nft commands for rules/ipset/stats/backup
- Rebuild install.sh: nftables dependency, WireGuard pre-check, PostUp/PostDown auto-integration
- Update build.sh/build.bat: match install.sh changes
- Update README.md: nftables prerequisites and references

build.sh

@@ -16,16 +16,82 @@ cat << 'MAIN_EOF' > "$INSTALL_SCRIPT"
 set -euo pipefail
 
 if [[ $EUID -ne 0 ]]; then
-   echo "This script must be run as root." 
+   echo "This script must be run as root."
    exit 1
 fi
 
+if ! command -v wg &>/dev/null; then
+    echo "[ERROR] WireGuard is not installed."
+    echo "  Debian/Ubuntu: apt install wireguard"
+    echo "  RHEL/CentOS:   dnf install wireguard-tools"
+    echo "  Arch:          pacman -S wireguard-tools"
+    exit 1
+fi
+
+if [[ ! -f /etc/wireguard/wg0.conf ]]; then
+    echo "[WARN] WireGuard config not found: /etc/wireguard/wg0.conf"
+    echo "  PostUp/PostDown hooks will not be added automatically."
+    echo "  Create your wg0.conf first, then re-install."
+fi
+
+WG_CONF="/etc/wireguard/wg0.conf"
+
+install_hooks() {
+    if [[ ! -f "$WG_CONF" ]]; then
+        return 0
+    fi
+
+    if grep -q "wg-sync-policy.sh" "$WG_CONF" 2>/dev/null; then
+        echo "[OK] PostUp/PostDown hooks already present in $WG_CONF"
+        return 0
+    fi
+
+    echo "Adding PostUp/PostDown hooks to $WG_CONF..."
+    cp "$WG_CONF" "${WG_CONF}.bak.$(date +%Y%m%d%H%M%S)"
+
+    local peer_line
+    peer_line=$(grep -n '^\[Peer\]' "$WG_CONF" | head -1 | cut -d: -f1)
+
+    if [[ -n "$peer_line" ]]; then
+        sed -i "${peer_line}i\\
+# WireGuard Policy Firewall hooks\\
+PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh\\
+PostDown = /usr/local/bin/wg-policy-cleanup.sh" "$WG_CONF"
+    else
+        {
+            echo ""
+            echo "# WireGuard Policy Firewall hooks"
+            echo "PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh"
+            echo "PostDown = /usr/local/bin/wg-policy-cleanup.sh"
+        } >> "$WG_CONF"
+    fi
+
+    echo "[OK] Hooks added to $WG_CONF"
+}
+
+remove_hooks() {
+    if [[ ! -f "$WG_CONF" ]]; then
+        return 0
+    fi
+
+    if ! grep -q "wg-sync-policy.sh" "$WG_CONF" 2>/dev/null; then
+        return 0
+    fi
+
+    echo "Removing PostUp/PostDown hooks from $WG_CONF..."
+    cp "$WG_CONF" "${WG_CONF}.bak.$(date +%Y%m%d%H%M%S)"
+    sed -i '/# WireGuard Policy Firewall hooks/d' "$WG_CONF"
+    sed -i '/wg-sync-policy\.sh/d' "$WG_CONF"
+    sed -i '/wg-policy-cleanup\.sh/d' "$WG_CONF"
+    echo "[OK] Hooks removed from $WG_CONF"
+}
+
 install_policy() {
     echo "Installing WireGuard Policy Firewall..."
 
     echo "Checking dependencies..."
     apt-get update -y || true
-    apt-get install -y jq inotify-tools ipset iptables || true
+    apt-get install -y jq inotify-tools nftables || true
 
     echo "Writing scripts to /usr/local/bin/..."
 
@@ -74,7 +140,9 @@ cat << 'MAIN_EOF_END' >> "$INSTALL_SCRIPT"
     echo "Enabling and starting services..."
     systemctl enable --now wg-policy.service
     systemctl enable --now wg-policy-health.timer
-    
+
+    install_hooks
+
     echo "Installation complete!"
     echo "You can check status with: wg-policy-ctl status"
 }
@@ -90,6 +158,8 @@ uninstall_policy() {
         /usr/local/bin/wg-policy-cleanup.sh || true
     fi
 
+    remove_hooks
+
     echo "Removing systemd units..."
     rm -f /etc/systemd/system/wg-policy.service
     rm -f /etc/systemd/system/wg-policy-health.service