feat(port-forward): sync port forwards to nftables + update docs

- server-core: DNAT + forward rules for TCP/UDP port forwarding
- AGENTS.md: update device-agent description (systray support)

AGENTS.md

@@ -13,7 +13,7 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 ├── apps/
 │   ├── server-core/    # Go/Gin API backend (submodule)
 │   ├── dashboard-ui/   # Vue 3 + Vite frontend (submodule)
-│   └── device-agent/   # Go stealth daemon (submodule)
+│   └── device-agent/   # Go stealth daemon + system tray (submodule)
 ├── docker-compose.yml  # Production orchestration
 ├── docker-compose.dev.yml  # Dev (air hot-reload)
 ├── Makefile            # up/down/dev/migrate/reset-db
@@ -50,7 +50,10 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 | Symbol | Type | Location | Role |
 |--------|------|----------|------|
 | `main()` (server-core) | func | `apps/server-core/main.go` | Entry: CLI flags + Gin init |
-| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: agent daemon lifecycle |
+| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: systray + agent daemon lifecycle |
+| `onReady()` / `onExit()` | func | `apps/device-agent/main.go` | System tray setup and cleanup |
+| `startAgent()` / `stopAgent()` | func | `apps/device-agent/main.go` | Agent connect/disconnect lifecycle |
+| `generateIcon()` | func | `apps/device-agent/icon.go` | 16x16 shield icon for tray |
 | `config.Load()` | func | `apps/server-core/internal/config/` | Env-based config loader |
 | `config.LoadConfFile()` | func | `apps/server-core/internal/config/config_loader.go` | Config file parser (.env / nexusguard.conf) |
 | `auth.Init()` | func | `apps/server-core/internal/auth/` | JWT sign/verify init |