feat: реализовать EvoFirewall V1 control plane

API, UI, Linux/MikroTik agents, IP lists, политики, stats, CI и интеграция с auth-portal/EvoBGP.

Co-authored-by: Cursor <[email protected]>

docs/integrate-auth-portal.md

@@ -0,0 +1,44 @@
+# Интеграция auth-portal ↔ EvoFirewall
+
+App id: **`fw`**.
+
+## Flow
+
+```
+Browser → EvoFirewall UI (нет token)
+       → redirect AUTH_PORTAL_URL/?return_to=…/auth/callback
+       → login
+       → redirect return_to#access_token=…
+       → /auth/callback сохраняет token
+       → API Authorization: Bearer <JWT>
+```
+
+## Permissions
+
+| Permission | UI |
+|------------|-----|
+| `fw:dashboard:read` | `/` |
+| `fw:agents:read` / `write` | `/agents` |
+| `fw:lists:read` / `write` | `/lists` |
+| `fw:policies:read` / `write` | `/rules`, overrides |
+| `fw:stats:read` | `/stats` |
+| `fw:settings:admin` | `/settings`, install-context |
+
+## Env
+
+```env
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=<тот же JWT_SECRET портала>
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+PUBLIC_BASE_URL=https://fw.example.com
+EVOFW_ENROLL_SEED=<hex/seed>
+```
+
+```env
+# apps/web/.env.local
+VITE_AUTH_ENABLED=true
+VITE_AUTH_PORTAL_URL=https://auth.shnt.top
+```
+
+В portal Admin → Apps выдайте app `fw` и нужные `fw:*`. URL в App Switcher: origin EvoFirewall.