feat(api, web): add Linux nft destination port hits for blocked IPs

Track tcp/udp dports via deny_port_hits, expose aggregate and per-IP ports in UI; install-link re-run refreshes nft rules.

Co-authored-by: Cursor <[email protected]>

docs/openapi.yaml

@@ -397,14 +397,14 @@ paths:
 
   /api/v1/agents/{id}/blocked-ips:
     get:
-      summary: Per-IP/CIDR drop counters (Linux nft/ipset)
+      summary: Per-IP/CIDR drop counters (Linux nft/ipset; MikroTik HITS)
       tags: [ops]
       security: [{ bearerAuth: [] }]
       parameters:
         - $ref: '#/components/parameters/Id'
       responses:
         '200':
-          description: Top blocked IPs by accumulated packets
+          description: Top blocked IPs by accumulated packets (+ optional top ports per IP on Linux)
           content:
             application/json:
               schema:
@@ -420,6 +420,43 @@ paths:
                         packets: { type: integer }
                         first_seen_at: { type: string, format: date-time }
                         last_seen_at: { type: string, format: date-time }
+                        ports:
+                          type: array
+                          description: Top destination ports for this IP (Linux nft)
+                          items:
+                            type: object
+                            required: [port, protocol, packets]
+                            properties:
+                              port: { type: integer, minimum: 1, maximum: 65535 }
+                              protocol: { type: string, enum: [tcp, udp] }
+                              packets: { type: integer }
+
+  /api/v1/agents/{id}/blocked-ports:
+    get:
+      summary: Aggregate destination ports hit by denied sources (Linux nft)
+      tags: [ops]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: Top ports by accumulated packets across all blocked IPs
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  items:
+                    type: array
+                    items:
+                      type: object
+                      required: [port, protocol, packets, last_seen_at]
+                      properties:
+                        port: { type: integer, minimum: 1, maximum: 65535 }
+                        protocol: { type: string, enum: [tcp, udp] }
+                        packets: { type: integer }
+                        last_seen_at: { type: string, format: date-time }
+
   /api/v1/integrations/evobgp/communities:
     get:
       summary: Proxy EvoBGP communities
@@ -520,7 +557,7 @@ paths:
 
   /v1/agent/apply-report:
     post:
-      summary: Apply report + packet stats (+ optional ip_hits)
+      summary: Apply report + packet stats (+ optional ip_hits / port_hits)
       tags: [agent]
       security: [{ agentToken: [] }]
       requestBody:
@@ -548,6 +585,18 @@ paths:
                     properties:
                       ip: { type: string, maxLength: 64 }
                       packets: { type: integer, minimum: 0 }
+                port_hits:
+                  type: array
+                  maxItems: 500
+                  description: Linux nft deny_port_hits (ip × proto × dport, packets > 0)
+                  items:
+                    type: object
+                    required: [ip, port, protocol, packets]
+                    properties:
+                      ip: { type: string, maxLength: 64 }
+                      port: { type: integer, minimum: 1, maximum: 65535 }
+                      protocol: { type: string, enum: [tcp, udp] }
+                      packets: { type: integer, minimum: 0 }
       responses:
         '200':
           description: OK