fix(api, web, docs): refine port ACL logic and documentation updates

- Updated the `evofw-firewall.sh` script to clarify the handling of incoming traffic for port ACLs, ensuring accurate rule application for Docker NAT and local addresses.
- Enhanced the UI description for port ACLs to specify that only incoming traffic is affected, improving user understanding of the firewall behavior.
- Revised documentation to reflect the updated logic for port ACLs, emphasizing the distinction between incoming and outgoing traffic and the implications for service accessibility.

These changes improve the clarity and functionality of port ACL management, enhancing user experience and system reliability.

apps/api/src/agent-scripts/evofw-firewall.sh

@@ -443,8 +443,8 @@ apply_nft() {
   ((${#batch[@]})) && nft_add_chunk "$table" "$name" allow_v4 "${batch[@]}"
 
   # input + forward: deny → Port ACL → allow → default.
-  # prerouting (mangle, before Docker NAT): established → deny → Port ACL only
-  # (no default drop — other traffic continues to host/Docker).
+  # prerouting (mangle, before Docker NAT): established → deny → Port ACL inbound only
+  # (fib daddr type local; no default drop — other traffic continues to host/Docker).
   if [[ "$DEFAULT_ACTION" == "drop" ]]; then
     nft add chain "$table" "$name" input '{ type filter hook input priority 0; policy drop; }'
     nft add chain "$table" "$name" forward '{ type filter hook forward priority 0; policy drop; }'
@@ -562,18 +562,26 @@ def emit_set(p):
     if chunk:
         print(f"nft add element inet evofw {setname} '{{ {', '.join(chunk)} }}'")
 
+def chain_match(chain):
+    if chain == "prerouting":
+        return "fib daddr type local "
+    if chain == "forward":
+        return "ct status dnat "
+    return ""
+
 def emit_rule(p, chain):
     verdict = "drop" if p["action"] == "close" else "accept"
     comment = f"evofw-port-{p['rid']}"
     proto, dport = p["proto"], p["dport"]
+    prefix = chain_match(chain)
     if p["is_all"]:
         print(
-            f'nft add rule inet evofw {chain} {proto} dport {dport} counter {verdict} comment "{comment}"'
+            f'nft add rule inet evofw {chain} {prefix}{proto} dport {dport} counter {verdict} comment "{comment}"'
         )
         return
     setname = f"port_src_{p['rid']}_{p['proto']}"
     print(
-        f'nft add rule inet evofw {chain} ip saddr @{setname} {proto} dport {dport} counter {verdict} comment "{comment}"'
+        f'nft add rule inet evofw {chain} {prefix}ip saddr @{setname} {proto} dport {dport} counter {verdict} comment "{comment}"'
     )
 
 parsed = [p for p in (parse_rule(r) for r in rules) if p]
@@ -598,8 +606,9 @@ for chain in CHAINS:
             continue
         seen.add(key)
         comment = f"evofw-port-implicit-{p['proto']}-{p['dport']}"
+        prefix = chain_match(chain)
         print(
-            f'nft add rule inet evofw {chain} {p["proto"]} dport {p["dport"]} counter drop comment "{comment}"'
+            f'nft add rule inet evofw {chain} {prefix}{p["proto"]} dport {p["dport"]} counter drop comment "{comment}"'
         )
 PY
   local cmd