feat(core): home router NAT after Java, measured with Java FILIUS

The core translates before the IP thread, as Java's NAT threads sit
between card and Ethernet: out, the WAN address and the entry's port (ICMP
keeps its identifier); in, by remote end, port and protocol, else by the
port forwarding, which then makes a dynamic entry; a ping at the WAN
address is answered by the router, packets from outside for the LAN are
dropped, both sides pass the router's firewall, TTL 1 going out gets time
exceeded. Dynamic entries expire at Java's check each second, 300 s times
the delay factor old (55 minutes at 90 %), refreshed only by what comes in.
The home router forwards as a router does.

Measured and not taken: when a LAN endpoint sends to a second remote end,
Java gives it the entry's WAN port but no entry, and the answer stays at
the router; the core adds an entry for each new remote end on that port.

The oracle now records every card of a node (the second card of routers
was missing); the ARP and RIP runs are recorded anew and still match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/core/src/runtime/snapshot.ts

@@ -13,6 +13,7 @@ import type {
   DhcpServerConfiguration,
   DnsServerConfiguration,
   FirewallConfiguration,
+  GatewayPortForwardingRow,
   InterfaceConfiguration,
   InterfaceKey,
   ManualRoute,
@@ -59,6 +60,8 @@ export interface TopologySnapshot {
   /** The DNS servers switched on (Java: aktiv), by node. */
   readonly dnsServerConfigurationsByNodeId: ReadonlyMap<Id, DnsServerConfiguration>;
   readonly firewallConfigurationsByNodeId: ReadonlyMap<Id, FirewallConfiguration>;
+  /** A home router's port forwarding (Java GatewayFirmware.staticNAT), by node. */
+  readonly portForwardingRowsByNodeId: ReadonlyMap<Id, readonly GatewayPortForwardingRow[]>;
   readonly switchConfigurationsByNodeId: ReadonlyMap<Id, SwitchConfiguration>;
 }
 
@@ -73,6 +76,7 @@ export interface TopologySnapshotInput {
   dhcpServerConfigurationsByNodeId?: ReadonlyMap<Id, DhcpServerConfiguration>;
   dnsServerConfigurationsByNodeId?: ReadonlyMap<Id, DnsServerConfiguration>;
   firewallConfigurationsByNodeId?: ReadonlyMap<Id, FirewallConfiguration>;
+  portForwardingRowsByNodeId?: ReadonlyMap<Id, readonly GatewayPortForwardingRow[]>;
   switchConfigurationsByNodeId?: ReadonlyMap<Id, SwitchConfiguration>;
 }
 
@@ -88,6 +92,7 @@ export function topologySnapshot(input: TopologySnapshotInput): TopologySnapshot
     dhcpServerConfigurationsByNodeId: input.dhcpServerConfigurationsByNodeId ?? new Map(),
     dnsServerConfigurationsByNodeId: input.dnsServerConfigurationsByNodeId ?? new Map(),
     firewallConfigurationsByNodeId: input.firewallConfigurationsByNodeId ?? new Map(),
+    portForwardingRowsByNodeId: input.portForwardingRowsByNodeId ?? new Map(),
     switchConfigurationsByNodeId: input.switchConfigurationsByNodeId ?? new Map(),
   };
 }