feat: machine status page, speed test, live presence, forwards without ufw (0.0.5)

Status page per machine: CPU load, RAM and disk of the client, sampled
by the agent only while the page is open and visible (one reading
serves every open tab), plus a button that has the agent measure its
link to the host: ping, down and up.

Online/offline now comes from the control polls the hub holds open, so
a dropped agent shows offline at once instead of 45 s later, and the
dashboard keeps the status column live.

A forward rule can be created "without ufw": the panel opens nothing in
ufw for it and so revokes nothing when it is deleted. The checkbox is
shown only while the ufw integration is on.

Dashboard row actions are icons; a status action is added.

internal/server/ufw.go

@@ -54,6 +54,16 @@ func (u *ufwManager) status() (installed, active, runnable bool) {
 	return installed, active, runnable
 }
 
+// enabled reports whether the integration is switched on and ufw is there to
+// drive. Unlike available it runs nothing, so pages can ask it freely.
+func (u *ufwManager) enabled() bool {
+	if !u.db.UfwEnabled() {
+		return false
+	}
+	_, err := exec.LookPath("ufw")
+	return err == nil
+}
+
 // available reports whether we can and should drive ufw now.
 func (u *ufwManager) available() bool {
 	if !u.db.UfwEnabled() {
@@ -148,7 +158,9 @@ func (u *ufwManager) pruneShared() {
 	}
 	used := map[string]bool{}
 	for _, f := range forwards {
-		used[f.Proto] = true
+		if !f.NoUfw {
+			used[f.Proto] = true
+		}
 	}
 	port := u.tunnelPort()
 	for _, r := range shared {
@@ -160,7 +172,8 @@ func (u *ufwManager) pruneShared() {
 
 // allowForward opens the host ports a forward rule needs: its host port (bound
 // to the rule so it is revoked with it) plus the shared tunnel port for direct
-// tcp/udp modes (bound to 0 — shared across rules).
+// tcp/udp modes (bound to 0 — shared across rules). A rule made "without ufw"
+// opens nothing, so nothing is revoked with it either.
 func (u *ufwManager) allowForward(rule ForwardRule) {
 	if !u.available() {
 		return
@@ -169,6 +182,9 @@ func (u *ufwManager) allowForward(rule ForwardRule) {
 }
 
 func (u *ufwManager) allowForwardPorts(rule ForwardRule) {
+	if rule.NoUfw {
+		return
+	}
 	// "http" (long-poll) and "tcp" forwards both listen on TCP on the host.
 	hostProto, direct := "tcp", rule.Proto == "tcp"
 	if rule.Proto == "udp" {