Block BitTorrent on the server

- awg-ctrl: optional nft table awg_torrent (GET/PUT /api/torrent, off by
  default). A connection is judged by its first packets, like Xray's
  sniffing: DHT, UDP trackers, uTP SYN, and with @ih support the plain
  TCP handshake and HTTP announce. A match marks the connection in
  conntrack and drops it whole; without @ih only the UDP part is used
- devices that tried are kept in a 10-minute set and flagged as
  "torrent" in user and device stats; with shaping on they sit in the
  background class while the flag lasts
- metrics: awg_torrent_block_enabled/active, awg_torrent_blocked_total,
  awg_torrent_devices and per-peer awg_peer_torrent
- panel: "Торренты" section in server settings, "торренты" chip on users
  and devices; Save sends only what changed

internal/ui/sub_admin.go

@@ -377,6 +377,7 @@ type devStat struct {
 	lastHS     float64
 	rx, tx     float64
 	background bool
+	torrent    bool
 }
 
 // masterDevices — статистика устройства по всем серверам ключа: онлайн, если есть свежий
@@ -420,6 +421,7 @@ func (s *Sub) masterDevices(m *masterRow) ([]any, error) {
 				st.tx += numOr(field(p, "tx"), 0)
 				// Устройство стоит на каждом сервере со своим IP; фоновым его делает любой из них.
 				st.background = st.background || field(p, "priority") == "background"
+				st.torrent = st.torrent || truthy(field(p, "torrent"))
 			}
 		}()
 	}
@@ -449,6 +451,7 @@ func (s *Sub) masterDevices(m *masterRow) ([]any, error) {
 			{Key: "version", Val: d.Version}, {Key: "created_at", Val: d.CreatedAt}, {Key: "last_seen", Val: nullInt(d.LastSeen)},
 			{Key: "rekey_requested", Val: d.RekeyRequested == 1}, {Key: "online", Val: st.online}, {Key: "lastHandshake", Val: st.lastHS},
 			{Key: "rx", Val: st.rx}, {Key: "tx", Val: st.tx}, {Key: "priority", Val: prio},
+			{Key: "torrent", Val: st.torrent},
 			{Key: "servers_total", Val: len(links)}, {Key: "servers_ok", Val: okN},
 		})
 	}