Connections, "every packet" rules, and a packet tracer

- Connections: the kernel's tracked connections, read and closed over
  ctnetlink (internal/conntrack, raw netlink like the drop log), with
  their NAT and TCP state; closing one makes the rules check its next
  packet again (GET /connections, POST /connections/close; hc
  connections; Traffic → Connections).
- Rules can check every packet (every_packet, --every-packet): before
  established connections are accepted, so a drop or reject also stops
  connections already open. They can't accept.
- A packet tracer (internal/trace): a table of its own, inet
  housecarl-trace, marks the packets a filter picks, `nft monitor trace`
  reports every rule and policy they meet in every table, and the tracer
  names what accepted or dropped them, Housecarl's rules by name (POST,
  GET, DELETE /trace; hc trace; Traffic → Trace). One trace at a time,
  at most 200 packets and 20 a second; the table goes when it ends.

e2e: 157 checks, among them an upload a normal block doesn't stop and an
every-packet one does, and a trace naming the blocking rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -42,6 +42,11 @@ func (s *Server) routes() {
 	m.HandleFunc("POST "+p+"/sets/{ref}/elements", s.authed(s.addElement))
 	m.HandleFunc("DELETE "+p+"/sets/{ref}/elements/{addr}", s.authed(s.deleteElement))
 	m.HandleFunc("GET "+p+"/quotas", s.authed(s.listQuotas))
+	m.HandleFunc("GET "+p+"/connections", s.authed(s.listConnections))
+	m.HandleFunc("POST "+p+"/connections/close", s.authed(s.closeConnections))
+	m.HandleFunc("GET "+p+"/trace", s.authed(s.getTrace))
+	m.HandleFunc("POST "+p+"/trace", s.authed(s.startTrace))
+	m.HandleFunc("DELETE "+p+"/trace", s.authed(s.stopTrace))
 	m.HandleFunc("POST "+p+"/rules/{ref}/reset-quota", s.authed(s.resetQuota))
 	m.HandleFunc("GET "+p+"/changesets", s.authed(s.listChangesets))
 	m.HandleFunc("POST "+p+"/changesets", s.authed(s.createChangeset))