Connections, "every packet" rules, and a packet tracer

- Connections: the kernel's tracked connections, read and closed over
  ctnetlink (internal/conntrack, raw netlink like the drop log), with
  their NAT and TCP state; closing one makes the rules check its next
  packet again (GET /connections, POST /connections/close; hc
  connections; Traffic → Connections).
- Rules can check every packet (every_packet, --every-packet): before
  established connections are accepted, so a drop or reject also stops
  connections already open. They can't accept.
- A packet tracer (internal/trace): a table of its own, inet
  housecarl-trace, marks the packets a filter picks, `nft monitor trace`
  reports every rule and policy they meet in every table, and the tracer
  names what accepted or dropped them, Housecarl's rules by name (POST,
  GET, DELETE /trace; hc trace; Traffic → Trace). One trace at a time,
  at most 200 packets and 20 a second; the table goes when it ends.

e2e: 157 checks, among them an upload a normal block doesn't stop and an
every-packet one does, and a trace naming the blocking rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/nft/nft.go

@@ -8,6 +8,7 @@
 package nft
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"encoding/json"
@@ -24,6 +25,7 @@ import (
 
 	"housecarl/internal/model"
 	"housecarl/internal/render"
+	"housecarl/internal/trace"
 )
 
 // Runner runs nft.
@@ -541,6 +543,41 @@ func (f *Firewall) ApplyScript(ctx context.Context, script string) error {
 	return f.Runner.ApplyScript(ctx, script)
 }
 
+// Trace follows packets: it starts `nft monitor trace`, puts the tracing
+// table (script) in, and passes each line to line until ctx ends; then
+// it takes the table out again, whatever happened.
+func (f *Firewall) Trace(ctx context.Context, script string, line func(string)) error {
+	c := f.Runner.cmd(ctx, "monitor", "trace")
+	out, err := c.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	var errb bytes.Buffer
+	c.Stderr = &errb
+	if err := c.Start(); err != nil {
+		return err
+	}
+	defer f.Runner.run(context.Background(), "", "delete", "table", "inet", trace.Table)
+	if err := f.Runner.ApplyScript(ctx, script); err != nil {
+		c.Process.Kill()
+		c.Wait()
+		return fmt.Errorf("starting the trace: %w", err)
+	}
+	sc := bufio.NewScanner(out)
+	sc.Buffer(make([]byte, 64<<10), 1<<20)
+	for sc.Scan() {
+		line(sc.Text())
+	}
+	err = c.Wait()
+	if ctx.Err() != nil {
+		return nil // stopped, or its time was up
+	}
+	if err != nil && errb.Len() > 0 {
+		return fmt.Errorf("nft monitor trace: %s", strings.TrimSpace(errb.String()))
+	}
+	return err
+}
+
 // DeleteTable deletes another table (takeover).
 func (f *Firewall) DeleteTable(ctx context.Context, family, name string) error {
 	if name == render.Table && family == "inet" {