feat: routing page — port forwarding tab, live iptables, diagnostics, firewall delete

Backend:
- routing_manager.remove_firewall_rule(): remove stored rule + iptables -D
- routing_manager.get_live_iptables(): dump filter/nat tables from cell-wireguard
- DELETE /api/routing/firewall/<rule_id> endpoint (was missing)
- GET /api/routing/live-iptables endpoint

Frontend Routing.jsx — 7 tabs:
- Overview: proper routing table with destination/gateway/interface columns
- Port Forwarding: clean DNAT form (protocol, ext port → internal IP:port)
- NAT Rules: MASQUERADE/SNAT only, cleaner layout
- Peer Routes: IP route entries through VPN peers
- Firewall: custom rules with working delete button
- Live iptables: read-only terminal view of actual running rules in cell-wireguard
- Diagnostics: ping + traceroute test from server with output display

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -1619,6 +1619,21 @@ def add_firewall_rule():
         logger.error(f"Error adding firewall rule: {e}")
         return jsonify({"error": str(e)}), 500
 
+@app.route('/api/routing/firewall/<rule_id>', methods=['DELETE'])
+def remove_firewall_rule(rule_id):
+    try:
+        result = routing_manager.remove_firewall_rule(rule_id)
+        return jsonify({'success': result}), (200 if result else 404)
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+@app.route('/api/routing/live-iptables', methods=['GET'])
+def get_live_iptables():
+    try:
+        return jsonify(routing_manager.get_live_iptables())
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
 @app.route('/api/routing/connectivity', methods=['POST'])
 def test_routing_connectivity():
     """Test routing connectivity."""