fix: dynamic firewall config + UFW support + anti-spoof bug fix

Root cause: UFW FORWARD policy DROP overrides lmvpn_nat accept rules.
DNS (small UDP) worked but TCP packets were silently dropped.

- Add firewall_linux.go: dynamic NAT/forward/UFW config from ApplySettings
- Add firewall_darwin.go/firewall_other.go: stubs
- Fix anti-spoof bug in switch.go: return dropPacket sentinel instead of
  nil, so spoofed packets are no longer written to TUN
- Simplify install_linux.sh: remove hardcoded subnets and NAT config
- Add UFW detection to diag panel

internal/vpn/service.go

@@ -155,6 +155,14 @@ func (s *VpnService) ApplySettings(settings model.VpnSetting, reservations4, res
 	s.mu.Unlock()
 
 	go s.serveTUN()
+
+	subnet4 := ipNet.String()
+	var subnet6Str string
+	if ipNet6 != nil {
+		subnet6Str = ipNet6.String()
+	}
+	configureFirewall(subnet4, subnet6Str, tun.Name())
+
 	log.Printf("VPN 服务已启动: tun=%s subnet=%s server=%s", tun.Name(), ipNet.String(), serverIP.String())
 	if ipNet6 != nil {
 		log.Printf("  IPv6: subnet=%s server=%s", ipNet6.String(), serverIP6.String())