feat(api, web): enhance agent traffic statistics and update installation scripts

- Improved the collection and reporting of agent traffic statistics, including total packets dropped and accepted, to provide a more comprehensive view of agent performance.
- Updated the `evofw-firewall.sh` script to capture and report traffic statistics before chain recreation, ensuring accurate data retention.
- Enhanced the installation script to support updates on already-installed agents, allowing for script and timer refresh without re-enrollment, while preserving existing credentials.
- Refactored UI components to utilize new traffic statistics, improving clarity and user experience in displaying agent performance metrics.

These changes enhance the overall functionality and usability of the agent management system, providing better insights and easier updates for users.

apps/api/src/agent-scripts/evofw-firewall.sh

@@ -118,12 +118,19 @@ nft_add_chunk() {
 
 collect_nft_stats() {
   PACKETS_DROPPED=0; PACKETS_ACCEPTED=0
-  local line
+  local line n
   while IFS= read -r line; do
-    if [[ "$line" == *drop* && "$line" =~ packets[[:space:]]+([0-9]+) ]]; then
-      PACKETS_DROPPED="${BASH_REMATCH[1]}"
-    elif [[ "$line" == *accept* && "$line" =~ packets[[:space:]]+([0-9]+) ]]; then
-      PACKETS_ACCEPTED="${BASH_REMATCH[1]}"
+    [[ "$line" =~ packets[[:space:]]+([0-9]+) ]] || continue
+    n="${BASH_REMATCH[1]}"
+    # Policy set hits only (ignore lo / established noise)
+    if [[ "$line" == *@deny_v4* ]]; then
+      PACKETS_DROPPED=$((PACKETS_DROPPED + n))
+    elif [[ "$line" == *@allow_v4* ]]; then
+      PACKETS_ACCEPTED=$((PACKETS_ACCEPTED + n))
+    elif [[ "$line" == *" counter drop"* && "$line" != *@* ]]; then
+      PACKETS_DROPPED=$((PACKETS_DROPPED + n))
+    elif [[ "$line" == *" counter accept"* && "$line" != *@* && "$line" != *established* && "$line" != *"iif \"lo\""* && "$line" != *"iif lo"* ]]; then
+      PACKETS_ACCEPTED=$((PACKETS_ACCEPTED + n))
     fi
   done < <(nft list chain inet evofw input 2>/dev/null || true)
 }
@@ -197,8 +204,11 @@ apply_ipset() {
 }
 
 send_report() {
-  if [[ "$KERNEL_METHOD" == "nft" ]] || command -v nft >/dev/null 2>&1; then
-    collect_nft_stats
+  # If caller already collected (pre-apply), keep those values.
+  if [[ -z "${STATS_CAPTURED:-}" ]]; then
+    if [[ "$KERNEL_METHOD" == "nft" ]] || command -v nft >/dev/null 2>&1; then
+      collect_nft_stats
+    fi
   fi
   local report
   report=$(printf '{"status":"ok","prefix_count":%s,"packets_dropped":%s,"packets_accepted":%s,"kernel_method":"%s","source":"agent"}' \
@@ -220,6 +230,12 @@ if [[ -f "$HASH_FILE" && "$(tr -d '\r\n' <"$HASH_FILE")" == "$HASH" && -n "$HASH
   exit 0
 fi
 
+# Capture counters BEFORE recreate (nft delete chain zeroes them).
+if command -v nft >/dev/null 2>&1; then
+  collect_nft_stats
+  STATS_CAPTURED=1
+fi
+
 case "$BACKEND" in
   nft|auto)
     if command -v nft >/dev/null 2>&1; then apply_nft