Block BitTorrent on the server

- awg-ctrl: optional nft table awg_torrent (GET/PUT /api/torrent, off by
  default). A connection is judged by its first packets, like Xray's
  sniffing: DHT, UDP trackers, uTP SYN, and with @ih support the plain
  TCP handshake and HTTP announce. A match marks the connection in
  conntrack and drops it whole; without @ih only the UDP part is used
- devices that tried are kept in a 10-minute set and flagged as
  "torrent" in user and device stats; with shaping on they sit in the
  background class while the flag lasts
- metrics: awg_torrent_block_enabled/active, awg_torrent_blocked_total,
  awg_torrent_devices and per-peer awg_peer_torrent
- panel: "Торренты" section in server settings, "торренты" chip on users
  and devices; Save sends only what changed

awg-ui/src/App.css

@@ -417,6 +417,7 @@ body {
 }
 .node-modal {
     width: 100%; max-width: 520px;
+    max-height: 100%; overflow-y: auto;
     background: var(--surface-bright);
     border: 1px solid var(--outline-variant);
     border-radius: var(--r-card);
@@ -445,6 +446,9 @@ body {
 .ss-field { display: flex; flex-direction: column; gap: 6px; min-width: 0; }
 .ss-status { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 12px; background: var(--surface-container); border-radius: var(--r-table); padding: 12px; }
 .ss-mono { font-family: var(--mono); font-size: 12px; color: var(--neutral-text); word-break: break-all; }
+.ss-section { margin: 4px 0 0; font-size: 14px; font-weight: 500; color: var(--on-surface); }
+.ss-divider { border: 0; border-top: 1px solid var(--outline-variant); margin: 4px 0; }
+.ss-seen { display: flex; flex-wrap: wrap; gap: 6px; }
 /* Тёплый чип «внимание»: канал занят, фоновый приоритет */
 .chip--warm { background: var(--tertiary-container); color: var(--on-tertiary-container); }
 .chip--warm .chip-dot { background: var(--on-tertiary-container); }