write the nftables rules of the daemon machine, and point at the generated files

write the nftables rules of the daemon machine, and point at the generated files

With the daemon on a machine of its own its ports are open to whoever
reaches them: the pool, where X-Real-Ip is believed and the bans are built
on it; the control channel, which holds the whole daemon up to 3 seconds
per connection; and php-fpm, when it listens on tcp to serve the front,
which runs any php file of that machine for whoever asks.

A "-m server" installation with -U tcp:// now writes in Etc <name>.nft,
<name> from the prefix like the nginx files, to be copied by hand into
/etc/nftables.d/. Its own table, accepting by default and dropping only
the ports of brisk: the pool reachable by the front alone, the control
channel by this machine alone, and lo accepted, because the daemon listens
on its own address and usermgmt.php reaches the control channel from here.
The address of the front comes from the new -I; without it nothing is
written and the run says so. An ipv6 address gives an ip6 saddr rule.

php-fpm is counted as serving the front when one of the pools in
/etc/php/*/fpm/pool.d listens on tcp on an address that is not loopback;
its port then joins the pool in both rules. A unix socket or 127.0.0.1
serves this machine alone and is left out, and the run says that php-fpm
has to be configured first if it is meant to serve the front.

The name of the installation and the size of the pool, until now worked
out inside nginx_conf_gen, are shared with it through inst_name, inst_var
and pool_size.

system/nginx/brisk.conf now says that -S nginx writes the same
configuration already aligned with the installation, and where; it and
WARNING.txt mention -I and the nftables file.

Checked by installing -m server into a scratch tree against fake php-fpm
pools - tcp on the lan, unix socket plus loopback, port alone, ipv6 - and
without -I: every file passes nft -c and loads in an isolated network
namespace. The -m front nginx files come out as before and no .nft.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>