feat: optional label on a forward rule

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/handlers_panel_fwd.go

@@ -87,7 +87,7 @@ func (s *Server) handleForwardAdd(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	rule := ForwardRule{AgentID: id, ClientPort: clientPort, HostPort: hostPort, ListenAddr: listenAddr, Proto: protoKind,
-		NoUfw: r.FormValue("no_ufw") != ""}
+		NoUfw: r.FormValue("no_ufw") != "", Label: forwardLabel(r.FormValue("label"))}
 	ruleID, err := s.db.CreateForwardRule(rule)
 	if err != nil {
 		http.Redirect(w, r, "/agents/"+id+"/forwards?err=db", http.StatusSeeOther)
@@ -130,3 +130,15 @@ func (s *Server) removeForward(rid int64) {
 	_ = s.db.DeleteForwardRule(rid)
 	s.ufw.revokeForRule(rid)
 }
+
+// forwardLabelMax bounds a rule's label, in characters.
+const forwardLabelMax = 80
+
+// forwardLabel tidies the optional note of a rule: one line, bounded length.
+func forwardLabel(v string) string {
+	v = strings.Join(strings.Fields(v), " ")
+	if r := []rune(v); len(r) > forwardLabelMax {
+		v = string(r[:forwardLabelMax])
+	}
+	return v
+}