[client] Unify peer and route ACL filtering with multi-source rules (#6322)

* Unify peer and route ACL filtering with multi-source peer rules

* Remove partial userspace firewall mode and open foreign chains via a table-less allower

* Snapshot iptables rule maps before persisting state

* Scope userspace firewall wildcard source rules per address family

* Install nftables peer filter and mangle rules in a single transaction

* Share the iptables jump rule spec between install and cleanup

* Fix legacy ACL source wildcard and keep rollback tracking on delete failure

* Fix CI: recognize multi-value port set lookups in tests and correct PeerIP lint suppression

* Fall back to per-prefix filter rules when ipset is unavailable

* Annotate legacy PeerIP usages in ACL tests and fix import formatting

* Keep firewall rule bookkeeping in step with the kernel on replace and teardown

* Release the routing reference when the route manager shuts down

* Keep set references and rule tracking consistent when a routing rule fails

client/ssh/server/test.go

@@ -1,9 +1,9 @@
 // This file is intentionally named test.go (not test_test.go) so the exported
 // StartTestServer helper is visible to the ssh/proxy and ssh/client external
 // test packages, not just this package's own tests. The //go:build !js tag
-// keeps its "testing" import — and the whole testing/flag/regexp transitive
-// chain it drags in — out of the wasm client, which links ssh/server through
-// the engine but never runs Go tests under GOOS=js.
+// keeps its "testing" import, along with the whole testing/flag/regexp
+// transitive chain it drags in, out of the wasm client, which links
+// ssh/server through the engine but never runs Go tests under GOOS=js.
 //go:build !js
 
 package server