feat(firewall): add IP set blocking convenience API with CIDR interval support and optional rule comments

ts/nft.rulebuilder.firewall.ts

@@ -84,10 +84,11 @@ export function buildIPSetCreate(
   config: INftIPSetConfig,
 ): string[] {
   const commands: string[] = [];
+  const flags = config.interval ? ' flags interval \\;' : '';
 
   // Create the set
   commands.push(
-    `nft add set ${family} ${tableName} ${config.name} { type ${config.type} \\; }`
+    `nft add set ${family} ${tableName} ${config.name} { type ${config.type} \\;${flags} }`
   );
 
   // Add initial elements if provided
@@ -154,10 +155,12 @@ export function buildIPSetMatchRule(
     direction: 'input' | 'output' | 'forward';
     matchField: 'saddr' | 'daddr';
     action: 'accept' | 'drop' | 'reject';
+    comment?: string;
   },
 ): string[] {
+  const comment = options.comment ? ` comment "${options.comment}"` : '';
   return [
-    `nft add rule ${family} ${tableName} ${options.direction} ip ${options.matchField} @${options.setName} ${options.action}`
+    `nft add rule ${family} ${tableName} ${options.direction} ip ${options.matchField} @${options.setName}${comment} ${options.action}`
   ];
 }