fix: dynamic firewall config + UFW support + anti-spoof bug fix

Root cause: UFW FORWARD policy DROP overrides lmvpn_nat accept rules.
DNS (small UDP) worked but TCP packets were silently dropped.

- Add firewall_linux.go: dynamic NAT/forward/UFW config from ApplySettings
- Add firewall_darwin.go/firewall_other.go: stubs
- Fix anti-spoof bug in switch.go: return dropPacket sentinel instead of
  nil, so spoofed packets are no longer written to TUN
- Simplify install_linux.sh: remove hardcoded subnets and NAT config
- Add UFW detection to diag panel

internal/vpn/tunnel.go

@@ -217,6 +217,9 @@ func runTunnel(conn *websocket.Conn, user *model.User) {
 		tc.rxBytes.Add(int64(len(data)))
 
 		targets := VPN.RouteFromClient(tc, data)
+		if isDrop(targets) {
+			continue
+		}
 		if len(targets) == 0 {
 			if err := VPN.WriteToTUN(data); err != nil {
 				log.Printf("用户 %s 写入 TUN 失败: %v", user.Username, err)