fix9: безопасный host firewall apply и строгий конфиг

- host_firewall секция стала обязательной (убран silent enable)\n- host firewall применяется атомарным nft batch\n- добавлен verify-after-apply с hard-fail при drift\n- усилен tolerant parser drift (кавычки, ipv6-icmp alias)\n- расширены unit-тесты config/firewall\n- дополнен acceptance checklist блоком host firewall

traffic_core/src/config.rs

@@ -30,7 +30,6 @@ fn default_input_policy() -> String {
 pub struct Config {
     pub amnezia: AmneziaConfig,
     pub traffic: TrafficConfig,
-    #[serde(default)]
     pub host_firewall: HostFirewallConfig,
     pub anti_torrent: AntiTorrentConfig,
     pub reboot: RebootConfig,
@@ -474,4 +473,44 @@ mod tests {
         };
         assert!(cfg.validate_config().is_err());
     }
+
+    #[test]
+    fn config_requires_host_firewall_section() {
+        let raw = r#"
+[amnezia]
+container_names = ["amnezia-awg2"]
+interface_candidates = ["awg0"]
+interface_patterns = ["awg*"]
+peer_ipv4_cidr = "10.8.1.0/24"
+
+[traffic]
+enabled = true
+peer_limit = "70mbit"
+root_rate = "1000mbit"
+reconcile_interval_secs = 15
+container_ready_timeout_secs = 30
+class_start_id = 10
+ifb_name = "ifb0"
+
+[anti_torrent]
+enabled = false
+max_connections_per_peer = 100
+peer_ipv4_cidr = "10.8.1.0/24"
+apply_in_amnezia_netns = false
+
+[reboot]
+enabled = false
+window_start_utc = "01:00"
+window_end_utc = "02:00"
+
+[swap]
+enabled = false
+path = "/swapfile"
+size_mb = 2048
+priority = 1
+swappiness = 1
+"#;
+        let parsed = toml::from_str::<Config>(raw);
+        assert!(parsed.is_err());
+    }
 }