feat(editor): F4.5d the firewall in the device sheet

Measured first: SheetRun drives FILIUS' firewall dialog down to its table
editor (Swing's own end of an edit). Java's table writes a cell into the
rule before it checks it, so that the firewall holds "abc", a mask of
255.0.255.0 or port 0 while the table shows the old value, and reads a
port that is no number as all ports. Here nothing the check refuses
reaches the rule.

- doc: the three switches, the default action, rules (new as Java's,
  cells by Java's checks: masks of ones then zeros, the directly connected
  marker as a source only, an empty port for all ports; protocol, action,
  moved up or down, removed)
- editor: the firewall as a page of the router's and home router's sheet,
  with Java's explanations; the general tab named so (Java: "network
  interfaces")

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/doc/src/sheet.ts

@@ -8,7 +8,9 @@ import {
   defaultSwitchConfiguration,
   DEFAULT_SWITCH_RETENTION_MILLISECONDS,
   dhcpServerConfiguration,
+  firewallConfiguration,
   forwardsIPv4ByDefault,
+  type FirewallConfiguration,
   parsePortForwardingRow,
   routeTableRows,
   type DhcpServerConfiguration,
@@ -90,6 +92,14 @@ export interface InterfaceSheet {
   readonly connected: { readonly device: string; readonly link: string } | null;
 }
 
+/** A router's or home router's firewall as Java's dialog shows it (JFirewallDialog). */
+export type FirewallSheet = Pick<FirewallConfiguration, 'isActive' | 'dropIcmp' | 'filterSynSegmentsOnly' | 'defaultPolicy' | 'rules'>;
+
+function firewallSheet(node: Y.Map<unknown>): FirewallSheet {
+  const { isActive, dropIcmp, filterSynSegmentsOnly, defaultPolicy, rules } = firewallConfiguration((fromY(settingsOf(node).get('firewall')) ?? {}) as Partial<FirewallConfiguration>);
+  return { isActive, dropIcmp, filterSynSegmentsOnly, defaultPolicy, rules };
+}
+
 export interface RouterSheet {
   readonly kind: 'router';
   readonly name: string;
@@ -100,6 +110,7 @@ export interface RouterSheet {
   readonly interfaces: readonly InterfaceSheet[];
   /** The manual rows, in their order. */
   readonly routes: readonly ManualRoute[];
+  readonly firewall: FirewallSheet;
   /** The whole table as Java shows it (Weiterleitungstabelle.holeTabelle): own addresses and networks, localhost, the manual rows, the gateway. */
   readonly table: readonly RouteRow[];
 }
@@ -114,6 +125,7 @@ export interface HomeRouterSheet {
   readonly wan: InterfaceSheet;
   readonly lan: InterfaceSheet;
   readonly dhcpServer: DhcpServerSheet;
+  readonly firewall: FirewallSheet;
   /** The port forwarding rows, each with whether Java's firmware forwards it (GatewayFirmware.validateData). */
   readonly portForwarding: readonly (GatewayPortForwardingRow & { readonly forwarded: boolean })[];
 }
@@ -237,6 +249,7 @@ export function deviceSheet(doc: Y.Doc, id: string): DeviceSheet | undefined {
         interfaces,
         routes,
         table: routeTableRows(interfaces, routes, gateway),
+        firewall: firewallSheet(node),
       };
     }
     case 'gateway': {
@@ -252,6 +265,7 @@ export function deviceSheet(doc: Y.Doc, id: string): DeviceSheet | undefined {
         lan: lan!,
         // Java's home router hands out its LAN address as the gateway, with the LAN card's mask.
         dhcpServer: dhcpServerSheet(node, { subnetMask: lan!.subnetMask, gateway: lan!.ipAddress, dnsServer: '' }, true),
+        firewall: firewallSheet(node),
         portForwarding: rows.map((row) => ({ ...row, forwarded: parsePortForwardingRow(row) !== undefined })),
       };
     }