Block BitTorrent on the server

- awg-ctrl: optional nft table awg_torrent (GET/PUT /api/torrent, off by
  default). A connection is judged by its first packets, like Xray's
  sniffing: DHT, UDP trackers, uTP SYN, and with @ih support the plain
  TCP handshake and HTTP announce. A match marks the connection in
  conntrack and drops it whole; without @ih only the UDP part is used
- devices that tried are kept in a 10-minute set and flagged as
  "torrent" in user and device stats; with shaping on they sit in the
  background class while the flag lasts
- metrics: awg_torrent_block_enabled/active, awg_torrent_blocked_total,
  awg_torrent_devices and per-peer awg_peer_torrent
- panel: "Торренты" section in server settings, "торренты" chip on users
  and devices; Save sends only what changed

internal/ctrl/server.go

@@ -55,6 +55,7 @@ type Server struct {
 	c     Config
 
 	shaping *Shaping
+	torrent *Torrent
 	metrics metricsCache
 	monitor monitorJob
 	cliPath string
@@ -155,6 +156,7 @@ func New() (*Server, error) {
 	}
 	s.log.Info("awg params loaded from conf", "Jc", params.Jc, "H1", params.H1, "gen", gen)
 	s.shaping = newShaping(s)
+	s.torrent = newTorrent(s)
 	return s, nil
 }
 
@@ -182,5 +184,6 @@ func (s *Server) Run() error {
 	// ни один из путей awg-quick up внутри awg-ctrl тогда не срабатывает.
 	go s.shaping.Apply()
 	s.shaping.Start()
+	go s.torrent.Apply() // nft-таблицы после перезагрузки нет — ставим заново
 	return <-errc
 }