feat: migrate policy firewall from iptables/ipset to nftables

- Rewrite wg-policy-lib.sh: replace ipset functions with nft helpers, add backup_nftables()
- Rewrite wg-policy-engine.sh: generate nft ruleset file, atomic load via nft -f, rollback support
- Simplify wg-policy-cleanup.sh: single nft delete table inet wg_policy
- Update wg-policy-ctl: nft commands for rules/ipset/stats/backup
- Rebuild install.sh: nftables dependency, WireGuard pre-check, PostUp/PostDown auto-integration
- Update build.sh/build.bat: match install.sh changes
- Update README.md: nftables prerequisites and references

wg-policy-cleanup.sh

@@ -9,63 +9,9 @@ source "${SCRIPT_DIR}/wg-policy-lib.sh"
 main() {
     log_info "Starting cleanup..."
 
-    local DEF_IF
-    DEF_IF="$(detect_default_if)"
+    nft delete table inet wg_policy 2>/dev/null || true
+    log_info "Removed nftables table inet wg_policy"
 
-    # === Base Routing Cleanup ===
-    while iptables -D FORWARD -o "$WG_IF" -j ACCEPT 2>/dev/null; do :; done
-    while iptables -t nat -D POSTROUTING -o "$DEF_IF" -j MASQUERADE 2>/dev/null; do :; done
-    log_info "Removed base routing and NAT rules"
-
-    # === IPv4 chain cleanup ===
-    local removed=0
-
-    while true; do
-        local line=""
-        line=$(iptables -nL FORWARD --line-numbers 2>/dev/null | grep "$CHAIN" | awk '{print $1}' | head -n 1 || true)
-        if [[ -n "$line" ]]; then
-            iptables -D FORWARD "$line" 2>/dev/null || break
-            (( removed++ ))
-        else
-            break
-        fi
-    done
-
-    if (( removed > 0 )); then
-        log_info "Removed $removed FORWARD references"
-    fi
-
-    iptables -F "$CHAIN" 2>/dev/null || true
-    iptables -X "$CHAIN" 2>/dev/null || true
-
-    # Cleanup backup chain too
-    iptables -F "$CHAIN_BACKUP" 2>/dev/null || true
-    iptables -X "$CHAIN_BACKUP" 2>/dev/null || true
-
-    # === IPv6 chain cleanup ===
-    if command -v ip6tables &>/dev/null; then
-        while true; do
-            local line6=""
-            line6=$(ip6tables -nL FORWARD --line-numbers 2>/dev/null | grep "$CHAIN" | awk '{print $1}' | head -n 1 || true)
-            if [[ -n "$line6" ]]; then
-                ip6tables -D FORWARD "$line6" 2>/dev/null || break
-            else
-                break
-            fi
-        done
-        ip6tables -F "$CHAIN" 2>/dev/null || true
-        ip6tables -X "$CHAIN" 2>/dev/null || true
-        ip6tables -F "$CHAIN_BACKUP" 2>/dev/null || true
-        ip6tables -X "$CHAIN_BACKUP" 2>/dev/null || true
-    fi
-
-    # === ipset cleanup ===
-    destroy_ipset "$IPSET_V4" 2>/dev/null || true
-    destroy_ipset "$IPSET_V6" 2>/dev/null || true
-    destroy_ipset "${IPSET_V4}_bak" 2>/dev/null || true
-    destroy_ipset "${IPSET_V6}_bak" 2>/dev/null || true
-
-    # === Lock cleanup ===
     rm -f "$LOCK_FILE" 2>/dev/null || true
 
     log_info "Cleanup complete"