feat(api, web): add Linux nft destination port hits for blocked IPs

Track tcp/udp dports via deny_port_hits, expose aggregate and per-IP ports in UI; install-link re-run refreshes nft rules.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/agent-scripts/install.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # EvoFirewall Linux install one-liner
-# Re-run on an already-installed host updates scripts/timer and keeps credentials
+# Re-run on an already-installed host updates scripts/timer **and forces nft
+# rule re-apply** (clears last_hash), keeping credentials
 # (unless EVOFW_INSTALL_FORCE=1 → full re-enroll).
 set -euo pipefail
 
@@ -250,10 +251,10 @@ if [[ -f "$CONF_FILE" && "${EVOFW_INSTALL_FORCE:-}" != "1" ]]; then
   download_sync_script "$SYNC_TMP" || exit 1
   write_conf "$CLIENT_ID" "$CLIENT_TOKEN" "$CLIENT_NAME" "$BACKEND"
   install_sync_and_uninstall "$SYNC_TMP"
-  # Force one apply after script refresh (nft set upgrade, counters, etc.).
+  # Force one apply after script refresh (nft set upgrade, counters, port hits, etc.).
   rm -f /var/lib/evofw/last_hash
   enable_scheduler_and_run
-  echo "Updated. Client id=${CLIENT_ID}. Sync script + timer refreshed."
+  echo "Updated. Client id=${CLIENT_ID}. Sync script + timer refreshed; nft rules re-applied."
   echo "Force sync: $SYNC_SCRIPT"
   echo "Uninstall: $UNINSTALL_SCRIPT  (or: curl -fsSL ${CP_URL}/v1/agent/uninstall.sh | bash)"
   exit 0