feat(nft): add source IP filtering for DNAT rules and expose table existence checks

ts/nft.rulebuilder.nat.ts

@@ -26,8 +26,9 @@ export function buildDnatRules(
 
   for (const proto of protocols) {
     // DNAT rule
+    const saddrFilter = rule.sourceIP ? `ip saddr ${rule.sourceIP} ` : '';
     commands.push(
-      `nft add rule ${family} ${tableName} prerouting ${proto} dport ${rule.sourcePort} dnat to ${rule.targetHost}:${rule.targetPort}`
+      `nft add rule ${family} ${tableName} prerouting ${saddrFilter}${proto} dport ${rule.sourcePort} dnat to ${rule.targetHost}:${rule.targetPort}`
     );
 
     // Masquerade (SNAT) unless preserveSourceIP is set