feat(firewall): add primitive command routing

Author: andrasbacsai

ARCHITECTURE.md

@@ -76,7 +76,7 @@ DELETE networks/{name}
 GET    networks
 
 # Firewall (coold = sole writer; dual-plane: iptables + nft bridge)
-firewall.allow            {namespace, src, dst, proto?, port?}  -> {id}
+firewall.allow            {id, namespace, src, dst, proto?, port?}  -> {id}
 firewall.revoke           {id}
 firewall.list             {?namespace}
 firewall.reconcile        {}  # flush + reload both snapshots

README.md

@@ -134,7 +134,7 @@ The v5 bootstrap firewall scaffold installs the cross-host and same-bridge enfor
 | Cross-host | iptables `COOLIFY-ALLOW` (filter) | wg0 ↔ bridge |
 | Intra-host same-bridge | nft `coolify_bridge::coolify_allow` (bridge family) | Same-bridge traffic bypassing FORWARD |
 
-Snapshots: `/etc/coolify/allow.rules` + `/etc/coolify/allow.nft`. Restored on boot by `coolify-mesh-fw.service` + `coolify-mesh-allow.service`. Rule ID = `sha256("namespace|src|dst|proto|port")[:12]`. Tuples only; audit / RBAC / owners live in Laravel.
+Snapshots: `/etc/coolify/allow.rules` + `/etc/coolify/allow.nft`. Restored on boot by `coolify-mesh-fw.service` + `coolify-mesh-allow.service`. Rule IDs are caller-provided stable handles from Laravel. Tuples only; audit / RBAC / owners live in Laravel.
 
 ---
 

coold/src/grpc/client.rs

@@ -159,6 +159,10 @@ fn primitive_capabilities() -> Vec<String> {
         "containers.healthcheck.run",
         "ingress.apply",
         "ingress.stop",
+        "firewall.allow",
+        "firewall.revoke",
+        "firewall.list",
+        "firewall.reconcile",
     ]
     .into_iter()
     .map(str::to_string)