feat(api): unify policy handling with default action updates

- Updated `evofw-firewall.sh` and related scripts to replace `policy_mode` with `default_action`, enhancing clarity and consistency in policy management.
- Adjusted agent routes and evaluation logic to accommodate the new default action structure, ensuring backward compatibility with legacy modes.
- Enhanced tests to validate the new default action behavior and its integration within the agent policy framework.
- Refactored related components in the web interface to align with the updated policy handling, improving user experience and reducing confusion around policy modes.

docs/architecture.md

@@ -17,18 +17,18 @@
 
 1. **Enroll** — `POST /v1/agent/enroll` + `X-EvoFW-Seed` → pending agent
 2. **Approve** — UI/API → status approved
-3. **Policy** — `GET /v1/agent/policy` → deny/allow CIDRs + mode + hash
+3. **Policy** — `GET /v1/agent/policy` → deny/allow CIDRs + `default_action` + hash (`apply_version: 2`)
 4. **Apply** — agent пишет kernel rules, `POST /v1/agent/apply-report` + stats sample
 5. **Lists refresh** — cron каждые 5 мин (json_url / domains / evobgp_community)
 
 ## Политика
 
 - Именованные **наборы правил** (`policy_sets`); агенту назначается **M:N** через `agent_policy_sets`
-- Правило в наборе: ровно один источник — IP-список (`list_id`), CIDR или DNS-имя (`hostname` → A/AAAA, кэш в `policy_rule_resolved`)
+- Правило в наборе: `action: deny | allow` + ровно один источник — IP-список (`list_id`), CIDR или DNS-имя (`hostname` → A/AAAA, кэш в `policy_rule_resolved`)
 - Evaluate: правила всех назначенных enabled-наборов (sort + priority) + `ip_overrides`
-- `blacklist` — default accept, apply deny set
-- `whitelist` — default drop, apply allow set (+ lo/established на Linux)
-- Overrides, смена наборов и refresh DNS/lists бампят `policy_generation`
+- Цепочка ядра **всегда**: deny → allow → `default_action` (`accept` | `drop` на агенте)
+- Exact overlap: `allow \ deny` (`conflicts_dropped`); deny wins
+- Overrides, смена наборов, `default_action` и refresh DNS/lists бампят `policy_generation`
 
 ## Auth