Build Housecarl 0.1.0: the nftables firewall manager

Zones, address sets (IPv4 and IPv6 mixed, dynamic sets with timeouts) and
services, ordered rules in the early, input, forward and output chains,
port forwards with hairpin NAT and IPv6 pinholes, source NAT, redirects,
and switchable built-ins (loopback, conntrack, ICMPv6, antispoofing, MSS
clamping, DHCPv6 client, flowtable). Every change is validated, checked
with nft -c and applied in one transaction to Housecarl's own table,
inet housecarl; changes made over the network roll back unless
confirmed, and the confirmed ruleset is loaded at boot by
housecarl-ruleset.service. An empty configuration applies nothing.

Also: hit counters and the drop log (nflog), 'hc import' of an existing
nftables ruleset and 'hc takeover', the hc CLI, the REST API and the web
UI, users, scoped tokens (sets:write:NAME), the audit log, the web UI's
certificate through Jarl, Debian packages, docs, unit tests with real
nft 1.1.3, and an e2e test with real traffic (71 checks).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,14 +6,60 @@ All notable changes to Housecarl are documented here. The format follows
 
 ## [Unreleased]
 
-The start of Housecarl, a firewall manager for nftables, built the way
-Jarl and Steward are.
+The first version of Housecarl, a firewall manager for nftables, built
+the way Jarl and Steward are.
 
 ### Added
 
+- **Zones, address sets and services:** interfaces grouped by what they
+  connect to (wildcards like `incusbr*`; external zones face the
+  internet); sets of IPv4 and IPv6 addresses, prefixes and ranges, mixed;
+  ports and ICMP types by name, with twenty built in (docs/rules.md).
+- **Rules** in four chains (input, forward, output, and early, before
+  connection tracking), in order, matching by zone, address, service,
+  family, connection state and status, days and hours, a rate (also per
+  source address), and a connection count; accept, drop, reject (ICMP or
+  TCP reset) or log. Raw nftables rules for the rest.
+- **IPv4 and IPv6 together:** one rule becomes the nftables rules each
+  family needs.
+- **NAT:** port forwards as one object (DNAT, the forward accept, hairpin
+  NAT, and optionally an IPv6 pinhole to a host's own port); source NAT
+  (masquerade or an address; NAT66 on request); redirects to the firewall
+  (docs/nat.md).
+- **Built-ins**, each switchable: loopback, established connections,
+  invalid packets, ICMPv6 (RFC 4890), ping from internal zones, DHCPv6
+  client replies, antispoofing with your own prefixes, MSS clamping, and
+  a flowtable fast path.
+- **Changes checked twice and applied atomically:** validation of the
+  whole configuration with stable problem codes (docs/validation.md),
+  then `nft -c`, then one `nft -f` transaction that replaces Housecarl's
+  own table, `inet housecarl`, and nothing else. Dynamic sets' entries
+  and the counters carry across.
+- **Probation:** a change made over the network rolls itself back unless
+  confirmed within two minutes (`hc confirm`, a banner in the web UI);
+  changes through the local socket are kept at once; a restart rolls
+  back what was pending. No rule is forced to keep SSH or the web UI
+  open.
+- **At boot:** the confirmed ruleset is loaded by
+  `housecarl-ruleset.service` before the network comes up, without
+  housecarld. An empty configuration applies nothing.
+- **Hits and the log:** packet and byte counters for every rule, NAT rule,
+  built-in and policy; packets logged by rules and policies, read from
+  netlink log group 4171 (`hc log -f`, the Log page).
+- **Dynamic sets** whose entries expire by themselves, changed through
+  their own API with tokens that may be limited to one set
+  (`sets:write:guests`).
+- **Import** of an existing nftables ruleset (`hc import`): rules keep
+  their order, defines name the sets, DNAT becomes port forwards, what
+  can't be translated stays as raw rules, with notes; `hc takeover`
+  deletes the old table, on probation (docs/import.md).
+- **The `hc` CLI, the REST API and the web UI** (dashboard, rules per
+  chain with hits and reordering, NAT, zones, sets, services, the log,
+  settings, import, history with undo), with users, roles, scoped API
+  tokens, sessions, the audit log, and the web UI's certificate from
+  Let's Encrypt through Jarl, as in Steward.
+- **Packaging:** Debian packages `housecarl` and `housecarl-cli`, a
+  systemd unit whose only privilege is `CAP_NET_ADMIN`, daily backups.
 - **The Housecarl logo:** a carved Nordic doorway in Jarl's blue, with a
   simplified version for small sizes, lighter on dark backgrounds; and a
   HOUSECARL wordmark in Jarl's and Steward's angular letters.
-- **The skeleton:** the `housecarld` daemon and the `hc` CLI (both only
-  print their version), the build, and the design sketch
-  (docs/design.md).