Zone matrix: partly, what is let through, hits; hc matrix aligned

A cell reads allow, block or partly (some new connections let through,
the rest not), with its exceptions counted by what they do (+3 -1), and
what they let through: services with the addresses they are limited to,
under the grid in hc matrix and in each cell on the Matrix page. A zone
to itself is marked: only traffic routed between its interfaces passes
the firewall. The details list each rule's hits. hc matrix pads the
grid by visible width: the colours' escape codes had thrown it out of
line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -334,9 +334,12 @@ run "the quota rule goes" 0 H rule delete -y "$QR"
 
 run "the matrix" 0 H matrix
 contains "^firewall  *allow"
+contains "^dhcp  *partly +[0-9]"
+contains "dhcp → wan  *.*from trusted_ips"
 run "LAN to the internet" 0 H matrix dhcp wan
-contains "allowed  *from trusted_ips  *rule forward #[0-9]* (Forward from trusted IPs)"
-contains "blocked  *the rest  *forward policy"
+contains "new connections: partly allowed"
+contains "allowed  *from trusted_ips  *rule forward #[0-9]* (Forward from trusted IPs)  *[0-9]"
+contains "blocked  *the rest  *forward policy  *[0-9]"
 not_contains "wg0_net"
 run "the internet to the firewall" 0 H matrix wan firewall
 contains "blocked  *sources that can't come from outside"