Statistics: traffic, drops, devices and connections over time

internal/stats samples every minute what the kernel already counts: the
interfaces' counters (per zone too), Housecarl's table (hits per rule,
built-in and policy; drops by chain; quotas; per-device sets), the
connection tracking table, and housecarld's and the host's memory, CPU
and load. Logged drops feed top lists of sources and what they tried.
Aggregates go to a database of their own (stats.db; per minute 7 days,
per hour 90 days, per day 2 years), with the store and queries from
Jarl's.

Traffic per inside device is a setting (stats_per_device): counting sets
stats_up/down_v4/v6 and rules at the top of the forward chain, IPv6 per
/64, carried across reloads. Set names starting with meter_, conn_,
quota_ or stats_ are reserved (set_name_reserved).

GET /stats/{status,summary,timeline,top,hits,heatmap}, hc stats, a
Statistics page with Jarl's charts, two charts on the dashboard, and a
conntrack_full warning. e2e: 188 checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -100,8 +100,9 @@ database: /w/data/housecarl.db
 ruleset: /w/data/ruleset.nft
 backup: {dir: /w/backups}
 log: {level: debug}
+stats: {database: /w/data/stats.db}
 EOF
-start() { R sh -c '(/w/housecarld -c /w/housecarl.yaml serve >> /w/srv.log 2>&1 &); for i in $(seq 1 30); do [ -S /run/housecarl/housecarl.sock ] && exit 0; sleep 0.3; done; exit 1'; }
+start() { R sh -c '(HOUSECARL_STATS_INTERVAL=3s /w/housecarld -c /w/housecarl.yaml serve >> /w/srv.log 2>&1 &); for i in $(seq 1 30); do [ -S /run/housecarl/housecarl.sock ] && exit 0; sleep 0.3; done; exit 1'; }
 
 # ---- today's router: the hand-written ruleset
 
@@ -284,6 +285,33 @@ run "the internet to the firewall" 0 H matrix wan firewall
 contains "blocked  *sources that can't come from outside"
 contains "allowed  *udp/51820"
 
+# ---- statistics (sampled every 3 seconds here)
+
+run "traffic per device on" 0 H settings set --stats-per-device on --log-drops on
+run "the device counters are in the ruleset" 0 R nft list set inet housecarl stats_up_v4
+send 500000 >/dev/null 2>&1
+run "a connection from the internet, dropped and logged" 1 connect net $WAN4 23
+sleep 8
+run "statistics are collected" 0 H stats status
+contains "Collecting:  *yes"
+contains "Per device:  *on"
+run "the summary" 0 H stats --since 1h
+contains "^wan  *[0-9.]* [KM]B"
+contains "Dropped:  *[1-9]"
+run "traffic per zone over time" 0 H stats traffic --since 1h --step 1m
+contains "wan ↓"
+run "the devices" 0 H stats top devices --since 1h
+contains "^$CLIENT4  *[0-9.]* KB  *[0-9.]* KB"
+run "the sources blocked" 0 H stats top blocked --since 1h
+contains "^$NET4  *[1-9]"
+run "what they tried" 0 H stats top tried --since 1h
+contains "^tcp/23"
+run "hits per rule" 0 H stats rules --since 1h
+contains "input policy  *[1-9]"
+contains "rule #[0-9]* (deleted)  *[1-9]"
+run "connections over time" 0 H stats connections --since 1h --step 1m
+contains "^[0-9-]* [0-9:]*  *[0-9]*  *[0-9]*"
+
 # ---- connections and tracing
 
 # A connection that stays open, masqueraded on its way out.