feat(api): unify policy handling with default action updates

- Updated `evofw-firewall.sh` and related scripts to replace `policy_mode` with `default_action`, enhancing clarity and consistency in policy management.
- Adjusted agent routes and evaluation logic to accommodate the new default action structure, ensuring backward compatibility with legacy modes.
- Enhanced tests to validate the new default action behavior and its integration within the agent policy framework.
- Refactored related components in the web interface to align with the updated policy handling, improving user experience and reducing confusion around policy modes.

packages/db/migrations/007_default_action.sql

@@ -0,0 +1,64 @@
+-- Replace exclusive blacklist/whitelist with default_action (accept|drop).
+-- Unified kernel chain: deny → allow → default_action.
+
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE agents_v3 (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  hostname TEXT,
+  platform TEXT NOT NULL DEFAULT 'linux',
+  token_prefix TEXT NOT NULL,
+  token_hash TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  default_action TEXT NOT NULL DEFAULT 'accept',
+  policy_generation INTEGER NOT NULL DEFAULT 1,
+  last_seen_at TEXT,
+  last_seen_ip TEXT,
+  last_apply_at TEXT,
+  last_apply_status TEXT,
+  last_apply_error TEXT,
+  last_apply_prefix_count INTEGER DEFAULT 0,
+  last_apply_packets_dropped INTEGER NOT NULL DEFAULT 0,
+  last_apply_packets_accepted INTEGER NOT NULL DEFAULT 0,
+  last_apply_kernel_method TEXT,
+  client_version TEXT,
+  settings_json TEXT NOT NULL DEFAULT '{}',
+  created_by_user_id TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  approved_at TEXT,
+  revoked_at TEXT,
+  CHECK (status IN ('invited', 'pending', 'approved', 'revoked')),
+  CHECK (platform IN ('linux', 'mikrotik')),
+  CHECK (default_action IN ('accept', 'drop')),
+  CHECK (length(trim(name)) > 0)
+);
+
+INSERT INTO agents_v3 (
+  id, name, hostname, platform, token_prefix, token_hash, status, default_action,
+  policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
+  last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
+  last_apply_packets_accepted, last_apply_kernel_method, client_version,
+  settings_json, created_by_user_id, created_at, approved_at, revoked_at
+)
+SELECT
+  id, name, hostname, platform, token_prefix, token_hash, status,
+  CASE
+    WHEN policy_mode = 'whitelist' THEN 'drop'
+    WHEN policy_mode = 'drop' THEN 'drop'
+    WHEN policy_mode = 'accept' THEN 'accept'
+    ELSE 'accept'
+  END,
+  policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
+  last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
+  last_apply_packets_accepted, last_apply_kernel_method, client_version,
+  settings_json, created_by_user_id, created_at, approved_at, revoked_at
+FROM agents;
+
+DROP TABLE agents;
+ALTER TABLE agents_v3 RENAME TO agents;
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_agents_token_hash ON agents (token_hash);
+CREATE INDEX IF NOT EXISTS idx_agents_status ON agents (status);
+
+PRAGMA foreign_keys = ON;