feat(fls): system software settings as Java loads them

readSystemSoftware adds to each node what the topology needs from its
system software: a switch's SSID and learning time, a host's wireless
SSID, a router's RIP switch, the manual routes and the firewall of a
router or home router. All 23 corpus files match Java.

- A router's firewall is one object its constructor hangs in two places;
  the corpus writes it under the web server's "konfig" plug-in. The
  places are merged.
- The decoder keeps entries a constructor made in a map, reached by
  get(key) (installed applications), like the elements of a list.
- The Java oracle loads every file twice and writes values that differ
  as null: what FILIUS rolls (MACs, a switch's SSID) without text search.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/fls/test/topology.test.ts

@@ -50,6 +50,26 @@ function asJavaView(topology: FlsTopology, javaBounds: (number[] | null)[]) {
         node.javaClass === 'Switch' || node.javaClass === 'Modem'
           ? Array.from({ length: node.portCount }, () => ({}))
           : node.interfaces.map((nic) => ({ ...nic, mac: nic.mac ?? null })),
+      system: {
+        ...node.system,
+        ...('ssid' in node.system ? { ssid: node.system.ssid ?? null } : {}),
+        ...(node.system.firewall === undefined
+          ? {}
+          : {
+              firewall: {
+                ...node.system.firewall,
+                rules: node.system.firewall.rules.map((rule) => [
+                  rule.srcIP,
+                  rule.srcMask,
+                  rule.destIP,
+                  rule.destMask,
+                  rule.port,
+                  rule.protocol,
+                  rule.action,
+                ]),
+              },
+            }),
+      },
     })),
     cables: topology.links.map((link) => ({
       ends: link.ends.map((end) => [end.node, end.port]),
@@ -177,6 +197,44 @@ describe('readTopology rules', () => {
     expect(wrongFirst.nodes).toEqual([]);
   });
 
+  it("reads a router's firewall wherever the file reaches it, with Java's defaults for what it leaves out", () => {
+    // Settings under the installed application and under the web server's
+    // plug-in belong to the one firewall the constructor made.
+    const { nodes } = topologyOf(`<object class="java.util.LinkedList">${nodeItem(`<object class="filius.hardware.knoten.Vermittlungsrechner">
+        <void property="systemSoftware"><void property="installierteAnwendungen">
+          <void method="get"><string>filius.software.firewall.Firewall</string>
+            <void property="allowRelatedPackets"><boolean>false</boolean></void>
+            <void property="ruleset">
+              <void method="add"><object class="filius.software.firewall.FirewallRule" id="FirewallRule0">
+                <void class="filius.software.firewall.FirewallRule" method="getField"><string>srcIP</string>
+                  <void method="set"><object idref="FirewallRule0"/><string>10.0.0.0</string></void></void>
+              </object></void>
+              <void method="add"><object class="filius.software.firewall.FirewallRule">
+                <string>1.1.1.1</string><string>255.255.255.255</string><string></string><string></string>
+                <int>53</int><short>17</short><short>1</short>
+              </object></void>
+            </void>
+          </void>
+          <void method="get"><string>filius.software.www.WebServer</string>
+            <void property="plugins"><void method="get"><string>konfig</string>
+              <void property="firewall"><void property="activated"><boolean>true</boolean></void></void>
+            </void></void>
+          </void>
+        </void></void></object>`)}</object>`);
+
+    expect(nodes[0]!.system.firewall).toEqual({
+      activated: true,
+      defaultPolicy: 0,
+      dropICMP: false,
+      filterSYNSegmentsOnly: false,
+      filterUdp: true,
+      rules: [
+        { srcIP: '10.0.0.0', srcMask: '', destIP: '', destMask: '', port: -1, protocol: 6, action: 0 },
+        { srcIP: '1.1.1.1', srcMask: '255.255.255.255', destIP: '', destMask: '', port: 53, protocol: 17, action: 1 },
+      ],
+    });
+  });
+
   it("reads colors as Java's constructors do and keeps an invalid one unset", () => {
     const colors = ['<int>16711935</int>', '<int>1</int><int>2</int><int>3</int>', '<int>1</int><int>2</int><int>300</int><int>4</int>'];
     const { documentation, warnings } = topologyOf(`<object class="java.util.LinkedList"/><object class="java.util.LinkedList"/>