feat(api, web): enhance port ACL logic and documentation

- Refined the `collect_nft_stats` function in `evofw-firewall.sh` to iterate over multiple chains, improving packet counting accuracy for dropped and accepted packets.
- Updated the port ACL handling to include new chains in the firewall rules, ensuring comprehensive coverage for input, forward, and prerouting.
- Enhanced the UI to clarify the behavior of port ACLs, emphasizing the distinction between EvoFW and system rules, and the implications of open ports.
- Improved documentation to reflect the updated port ACL logic and its interaction with Docker NAT, ensuring users understand the new behavior.

These changes enhance the functionality and clarity of port ACL management, improving user experience and system reliability.

apps/web/src/components/agents/agent-port-acl.tsx

@@ -514,7 +514,9 @@ export function AgentPortAcl({ agentId }: AgentPortAclProps) {
   }, [evofwRules, systemRows])
 
   const data = useMemo(() => {
-    if (ownerFilter === 'all') return allRows
+    if (ownerFilter === 'all') {
+      return allRows.filter((r) => !(r.owner === 'system' && r.overridden))
+    }
     return allRows.filter((r) => r.owner === ownerFilter)
   }, [allRows, ownerFilter])
 
@@ -687,8 +689,8 @@ export function AgentPortAcl({ agentId }: AgentPortAclProps) {
             <div className="flex flex-col gap-px">
               <FrameTitle>Port ACL</FrameTitle>
               <FrameDescription>
-                Open по списку делает порт whitelist (остальные src — drop).
-                Системные порты с хоста можно переопределить. Apply через nft
+                Open по списку — порт только с этих IP (хост и Docker).
+                Системные порты можно переопределить. Apply через nft
                 (upgrade install-ссылкой).
               </FrameDescription>
             </div>