feat: open a port in ufw by hand from the panel settings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/db.go

@@ -402,7 +402,20 @@ type UfwRule struct {
 	ID     int64
 	Port   int
 	Proto  string
-	RuleID int64 // bound forward rule id, or 0 for shared/manual (e.g. the tunnel port)
+	RuleID int64 // bound forward rule id, 0 for shared (the tunnel port), ufwManual for one added in Settings
+}
+
+// ufwManual is the RuleID of a ufw rule the admin added by hand: no forward
+// owns it, so only the admin removes it.
+const ufwManual = -1
+
+// Manual reports whether the admin added the rule by hand.
+func (r UfwRule) Manual() bool { return r.RuleID == ufwManual }
+
+// SetUfwRuleManual hands a tracked rule over to the admin.
+func (db *DB) SetUfwRuleManual(port int, proto string) error {
+	_, err := db.sql.Exec(`UPDATE ufw_rules SET rule_id = ? WHERE port = ? AND proto = ?`, ufwManual, port, proto)
+	return err
 }
 
 func (db *DB) AddUfwRule(port int, proto string, ruleID int64) error {