feat(firewall): add deny-by-default host firewall (harden-firewall.sh)

Add a reusable iptables baseline that hardens hosts with ICMP + SSH
defaults and lets deployments register the ports they need. INPUT is
deny-by-default (loopback, established, ICMP, SSH on the configured port,
plus registered ports); OUTPUT stays open and FORWARD is left untouched so
Docker container networking is unaffected.
Persistence is native -- no boot hook. Rules are saved and restored by the
distro's own package (iptables/ip6tables on Alpine, iptables-persistent on
Debian, iptables-services on Alma) via the new oslib helpers
install_iptables / fw_save_cmd / fw_enable_restore. The saved ruleset
carries the INPUT->sshguard jump, so brute-force protection survives reboot
without the old sshguard-iptables hook.
A self-contained /usr/local/sbin/firewall-apply rebuilds INPUT from
declarative drop-ins under /etc/firewall/ports.d and runs the native save,
so deployments add a port without needing the repo present:
  printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/mystack.rule
  /usr/local/sbin/firewall-apply
- SSH port read live from sshd_config (custom bastion ports just work);
  FW_SSH_SOURCE restricts the source CIDR; FW_ALLOW_PING gates echo
- harden-ssh.sh / harden-jumphost.sh install it when ENABLE_FIREWALL=1
  (default) and skip the sshguard-only hook; ENABLE_FIREWALL=0 keeps it
- cloud-init base.yml / jumphost.yml forward the toggle
- the four stack deploy.sh open_web_ports() register 80/443 via the
  firewall (ufw/firewalld kept as fallback); Docker-published ports bypass
  INPUT, so this is belt-and-braces and self-documenting
- README + cloud-init/README document the mechanism, Docker caveat, and the
  `disable` recovery path

scripts/oslib.sh

@@ -414,6 +414,59 @@ install_bruteforce_protection() {
     esac
 }
 
+# ============================================================================
+# Host firewall -- native iptables persistence (NO boot hook).
+# ============================================================================
+# Each family ships a package that saves the live ruleset to disk and restores
+# it at boot. harden-firewall.sh builds the INPUT rules live, then persists via
+# fw_save_cmd and enables boot restore via fw_enable_restore -- so the firewall
+# survives reboot without any custom boot hook.
+#
+#   family   persistence package        save target(s)                  restore svc
+#   alpine   iptables ip6tables         /etc/iptables/rules{,6}-save     iptables, ip6tables
+#   debian   iptables-persistent        /etc/iptables/rules.v{4,6}       netfilter-persistent
+#   rhel     iptables-services          /etc/sysconfig/{,ip6}tables      iptables, ip6tables
+
+# Install iptables + the family's native persistence package.
+install_iptables() {
+    _require_detected
+    case "$OS_FAMILY" in
+        alpine) pkg_install iptables ip6tables ;;
+        debian)
+            # iptables-persistent's postinst asks (debconf) whether to save the
+            # CURRENT rules on install. Preseed "no" so it never blocks on a
+            # prompt; harden-firewall.sh saves explicitly once its rules are up.
+            echo 'iptables-persistent iptables-persistent/autosave_v4 boolean false' | debconf-set-selections 2>/dev/null || true
+            echo 'iptables-persistent iptables-persistent/autosave_v6 boolean false' | debconf-set-selections 2>/dev/null || true
+            pkg_install iptables iptables-persistent ;;
+        rhel)   pkg_install iptables-services ;;
+    esac
+}
+
+# Echo the family's native "persist the live ruleset to disk" command. This is
+# baked verbatim into the generated /usr/local/sbin/firewall-apply so the saved
+# rules survive reboot even on a host that never sees this repo again.
+fw_save_cmd() {
+    _require_detected
+    case "$OS_FAMILY" in
+        alpine) echo 'rc-service iptables save >/dev/null 2>&1 || true; rc-service ip6tables save >/dev/null 2>&1 || true' ;;
+        debian) echo 'netfilter-persistent save >/dev/null 2>&1 || true' ;;
+        rhel)   echo 'iptables-save > /etc/sysconfig/iptables 2>/dev/null || true; ip6tables-save > /etc/sysconfig/ip6tables 2>/dev/null || true' ;;
+    esac
+}
+
+# Enable the family's native boot-time restore service(s). Rules are already
+# live when this runs, so we only need them re-applied on the NEXT boot --
+# enable, don't start.
+fw_enable_restore() {
+    _require_detected
+    case "$OS_FAMILY" in
+        alpine) svc_enable iptables; svc_enable ip6tables ;;
+        debian) svc_enable netfilter-persistent ;;
+        rhel)   svc_enable iptables; svc_enable ip6tables ;;
+    esac
+}
+
 # ============================================================================
 # gum (Charm TUI) -- multi-OS installer. Best-effort; callers that can fall
 # back to CLI prompts should not treat failure as fatal.