feat: реализовать EvoFirewall V1 control plane

API, UI, Linux/MikroTik agents, IP lists, политики, stats, CI и интеграция с auth-portal/EvoBGP.

Co-authored-by: Cursor <[email protected]>

docs/architecture.md

@@ -0,0 +1,33 @@
+# Архитектура EvoFirewall
+
+Централизованный control plane для firewall-агентов (Linux nft/ipset, MikroTik address-list).
+
+## Компоненты
+
+| Компонент | Путь | Роль |
+|-----------|------|------|
+| Web SPA | `apps/web` | ReUI Frame, TanStack Router/Query |
+| API | `apps/api` | Fastify 5, JWT + agent tokens |
+| DB | `packages/db` | Drizzle + SQLite WAL |
+| Shared | `packages/shared` | Zod-контракты, RBAC helpers |
+| UI | `packages/ui` | shadcn primitives `@evofw/ui` |
+| Agents | `apps/api/src/agent-scripts` | install.sh, sync, MikroTik RSC |
+
+## Потоки
+
+1. **Enroll** — `POST /v1/agent/enroll` + `X-EvoFW-Seed` → pending agent
+2. **Approve** — UI/API → status approved
+3. **Policy** — `GET /v1/agent/policy` → deny/allow CIDRs + mode + hash
+4. **Apply** — agent пишет kernel rules, `POST /v1/agent/apply-report` + stats sample
+5. **Lists refresh** — cron каждые 5 мин (json_url / domains / evobgp_community)
+
+## Политика
+
+- `blacklist` — default accept, apply deny set
+- `whitelist` — default drop, apply allow set (+ lo/established на Linux)
+- Overrides и clone-from бампят `policy_generation`
+
+## Auth
+
+- Portal SSO app id **`fw`**, permissions `fw:*`
+- Agent bearer token (sha256 hash в БД)