feat(api, web): add Linux nft destination port hits for blocked IPs

Track tcp/udp dports via deny_port_hits, expose aggregate and per-IP ports in UI; install-link re-run refreshes nft rules.

Co-authored-by: Cursor <[email protected]>

packages/db/migrations/010_agent_port_block_stats.sql

@@ -0,0 +1,21 @@
+-- Per-(ip, protocol, port) deny drop counters from Linux nft dynamic set.
+CREATE TABLE IF NOT EXISTS agent_port_block_stats (
+  id TEXT PRIMARY KEY NOT NULL,
+  agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  ip TEXT NOT NULL,
+  port INTEGER NOT NULL,
+  protocol TEXT NOT NULL,
+  packets INTEGER NOT NULL DEFAULT 0,
+  last_reported_packets INTEGER NOT NULL DEFAULT 0,
+  first_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_port_block_stats_agent_ip_port_proto
+  ON agent_port_block_stats(agent_id, ip, port, protocol);
+
+CREATE INDEX IF NOT EXISTS idx_agent_port_block_stats_agent_packets
+  ON agent_port_block_stats(agent_id, packets);
+
+CREATE INDEX IF NOT EXISTS idx_agent_port_block_stats_agent_port_proto
+  ON agent_port_block_stats(agent_id, port, protocol);