feat(api): enhance host firewall handling and validation

- Introduced a new `sanitizeHostFirewall` function to filter and validate host firewall rules and listeners, ensuring only valid entries are processed.
- Updated the `apply-report` endpoint to prevent overwriting existing host firewall snapshots with empty payloads, improving data integrity.
- Enhanced the `applyReportHostFirewallSchema` to define the expected structure for host firewall data, allowing for better validation and error handling.
- Added tests to verify the behavior of the new sanitization logic and the preservation of existing snapshots, ensuring robustness in the API's handling of firewall data.

These changes improve the reliability and accuracy of host firewall data management within the API, enhancing overall monitoring capabilities.

packages/shared/src/contracts.ts

@@ -269,6 +269,12 @@ export const hostFirewallPayloadSchema = z.object({
   listeners: z.array(hostListenerSchema).max(200).default([]),
 })
 
+/** Wire format for apply-report — unknown elements filtered in route (safeParse). */
+export const applyReportHostFirewallSchema = z.object({
+  rules: z.array(z.unknown()).max(500).optional().default([]),
+  listeners: z.array(z.unknown()).max(200).optional().default([]),
+})
+
 export const applyReportBodySchema = z.object({
   status: z.string(),
   prefix_count: z.number().int().optional(),
@@ -282,7 +288,7 @@ export const applyReportBodySchema = z.object({
   /** Linux nft dynamic set per-(ip, proto, dport) deny hits (top-N). */
   port_hits: z.array(applyReportPortHitSchema).max(500).optional(),
   /** Observed host firewall + listeners (Linux). */
-  host_firewall: hostFirewallPayloadSchema.optional(),
+  host_firewall: applyReportHostFirewallSchema.optional(),
 })
 
 export const agentPortRuleActionSchema = z.enum(['open', 'close'])