feat: routing page — port forwarding tab, live iptables, diagnostics, firewall delete

Backend:
- routing_manager.remove_firewall_rule(): remove stored rule + iptables -D
- routing_manager.get_live_iptables(): dump filter/nat tables from cell-wireguard
- DELETE /api/routing/firewall/<rule_id> endpoint (was missing)
- GET /api/routing/live-iptables endpoint

Frontend Routing.jsx — 7 tabs:
- Overview: proper routing table with destination/gateway/interface columns
- Port Forwarding: clean DNAT form (protocol, ext port → internal IP:port)
- NAT Rules: MASQUERADE/SNAT only, cleaner layout
- Peer Routes: IP route entries through VPN peers
- Firewall: custom rules with working delete button
- Live iptables: read-only terminal view of actual running rules in cell-wireguard
- Diagnostics: ping + traceroute test from server with output display

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

webui/src/services/api.js

@@ -137,6 +137,7 @@ export const routingAPI = {
   getFirewallRules: () => api.get('/api/routing/firewall'),
   addFirewallRule: (rule) => api.post('/api/routing/firewall', rule),
   deleteFirewallRule: (ruleId) => api.delete(`/api/routing/firewall/${ruleId}`),
+  getLiveIptables: () => api.get('/api/routing/live-iptables'),
   // Other
   addExitNode: (node) => api.post('/api/routing/exit-nodes', node),
   addBridgeRoute: (route) => api.post('/api/routing/bridge', route),