Keep built-ins and policies out of the busiest rules

The established built-in passes most of the traffic, so it topped the
statistics' busiest rules every time and made every rule's bar look
empty. The summary now lists rules and NAT objects in rules, and
built-ins and policies in builtins; the Statistics page and hc stats
show them as two lists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/hc/stats.go

@@ -33,6 +33,7 @@ type statSummary struct {
 	Drops           int64         `json:"drops"`
 	DropsByChain    []statEntry   `json:"drops_by_chain"`
 	Rules           []statEntry   `json:"rules"`
+	BuiltIns        []statEntry   `json:"builtins"`
 	PeakConnections int64         `json:"peak_connections"`
 	ConntrackMax    int64         `json:"conntrack_max"`
 	BlockedSources  []statEntry   `json:"blocked_sources"`
@@ -136,6 +137,7 @@ func printSummary(w io.Writer, s statSummary) {
 	}
 	packets := func(n int64) string { return humanCount(uint64(n)) + " packets" }
 	list("Busiest rules:", s.Rules, packets)
+	list("Built-ins and policies:", s.BuiltIns, packets)
 	list("Blocked most (logged drops):", s.BlockedSources, packets)
 	list("What they tried:", s.BlockedPorts, packets)
 	list("Devices, sent:", s.DevicesUp, humanBytes)