feat(firewall): atomic iptables operations

- all operations rollback on failure
- disabling the firewall means rolling back to its state before enabling it
- aligns with nftables atomicity feature

internal/firewall/firewall.go

@@ -23,6 +23,7 @@ type Config struct {
 
 	// State
 	enabled           bool
+	restore           func(context.Context)
 	vpnConnection     models.Connection
 	vpnIntf           string
 	outboundSubnets   []netip.Prefix