Zone matrix: what the rules do between zones

internal/matrix walks each pair's rules in order, as nftables would, for
new connections: zone → zone (forward), zone → the firewall (input) and
back (output), with the built-ins that act on new connections. A rule
for the whole pair decides it; one for part of its traffic (addresses,
services, times, rates, a quota) is an exception; the rest falls to the
policy. Rules whose addresses all lie in networks connected to other
zones are left out of a pair. GET /matrix (with ?changeset, pending
changes), hc matrix [FROM TO], and a Matrix page whose cells open their
rules.

e2e: 166 checks, among them the matrix of the maintainer's imported
ruleset.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -272,6 +272,18 @@ run "the reset is audited" 0 H audit --action quota.
 contains "quota.reset"
 run "the quota rule goes" 0 H rule delete -y "$QR"
 
+# ---- the zone matrix, of the imported ruleset
+
+run "the matrix" 0 H matrix
+contains "^firewall  *allow"
+run "LAN to the internet" 0 H matrix dhcp wan
+contains "allowed  *from trusted_ips  *rule forward #[0-9]* (Forward from trusted IPs)"
+contains "blocked  *the rest  *forward policy"
+not_contains "wg0_net"
+run "the internet to the firewall" 0 H matrix wan firewall
+contains "blocked  *sources that can't come from outside"
+contains "allowed  *udp/51820"
+
 # ---- connections and tracing
 
 # A connection that stays open, masqueraded on its way out.