fix: harden firewall and traffic reconciliation

tools/README.md

@@ -72,7 +72,7 @@ cp /usr/share/doc/awg2-harness/repo/config.example.toml /etc/awg2-harness/config
 nano /etc/awg2-harness/config.toml
 ```
 
-Перед первым `apply-firewall` обязательно сверяйте `ssh_port`, `amnezia_port` и `peer_ipv4_cidr` с реальным состоянием хоста и Amnezia.
+Перед первым `apply-firewall` обязательно сверяйте `host_firewall.ssh_port`, `amnezia.expected_host_udp_port` и `peer_ipv4_cidr` с реальным состоянием хоста и Amnezia. Ожидаемый UDP port является диагностическим контрактом Docker publish и не открывается отдельным правилом в host `INPUT`.
 
 ## Что скрипт намеренно не делает
 

tools/build.sh

@@ -37,6 +37,7 @@ BUILD_PACKAGES=(
 
 RUNTIME_PACKAGES=(
   iproute2
+  iptables
   nftables
   kmod
   util-linux
@@ -381,11 +382,12 @@ Section: net
 Priority: optional
 Architecture: amd64
 Maintainer: AWG2 Harness
-Depends: libc6, iproute2, nftables, kmod, util-linux, procps, systemd
+Depends: libc6, iproute2, iptables, nftables, kmod, util-linux, procps, systemd
 Description: Host-side orchestrator for AmneziaWG traffic shaping and lifecycle recovery
  AWG2 Harness manages AmneziaWG traffic shaping, IFB ingress shaping,
- nftables anti-torrent guard, reboot scheduling, swap setup and daemonized
- drift recovery on dedicated Debian hosts. Includes external reboot scheduler.
+ iptables host firewall, nftables anti-torrent guard, reboot scheduling,
+ swap setup and daemonized drift recovery on dedicated Debian hosts.
+ Includes external reboot scheduler.
 EOF
 
   cat >"$staging/DEBIAN/postinst" <<'EOF'
@@ -406,7 +408,7 @@ echo "Then run preflight before enabling services:"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-config"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml validate-runtime"
 echo "  awg2-harness --config /etc/awg2-harness/config.toml status"
-echo "Enable services only after SSH, Amnezia port and peer CIDR are verified."
+echo "Enable services only after SSH, expected Amnezia UDP port and peer CIDR are verified."
 echo "  systemctl enable --now awg2-harness.service awg2-reboot-scheduler.service"
 
 exit 0