feat(packages): add nftablesbuilder package

Web interface to manage nftables rules with drag-and-drop rule creation.

Upstream source is incomplete (missing settings crate, no GUI build
tooling), so the package builds the Rust workspace from the pinned
commit with a patched-in settings crate (schema recovered from official
release artifacts) and reuses the prebuilt GUI from the hash-pinned
release tarball on nftablesbuilder.eu.

README.md

@@ -21,6 +21,7 @@ A custom Nix overlay and flake providing additional packages not found in upstre
 | `hipengine` | ROCm-native local LLM inference engine with torch-free runtime for AMD RDNA GPUs | AI Inference |
 | `mcp-gateway` | Universal Model Context Protocol gateway that sits between AI client and MCP tools/servers | MCP Servers |
 | `nftables-analyzer` | Analyze nftables firewall rules and evaluate traffic queries | Networking |
+| `nftablesbuilder` | Web interface to manage nftables rules with drag-and-drop rule creation | Networking |
 | `skillsmcp` | MCP server that exposes Agent Skills to AI agents via the Model Context Protocol | MCP Servers |
 | `kubernetes-mcp-server` | Model Context Protocol (MCP) server for Kubernetes and OpenShift | MCP Servers |
 | `loop` | Corporate messenger for your team | Communication |
@@ -83,6 +84,31 @@ nix run git+https://git.millerson.name/alex/millerson-overlay.nix.git#mcp-gatewa
 nix profile install git+https://git.millerson.name/alex/millerson-overlay.nix.git#mcp-gateway
 ```
 
+### nftablesbuilder Runtime Notes
+
+`nftablesbuilder` is a web interface for managing nftables. It consists of a
+root-launcher (`nftablesbuilder`) that spawns the unprivileged `webserver`
+binary and pipes encrypted commands between it and the `nft` binary.
+
+Before running it you must:
+
+1. Copy the settings template to `/etc/nftablesbuilder` (the only fixed path):
+   ```bash
+   nix build .#nftablesbuilder
+   cp result/share/nftablesbuilder/settings.example /etc/nftablesbuilder
+   ```
+   Adjust paths inside (html, webserver, nft, savepath, TLS files).
+2. Create a TLS key/certificate pair at the paths referenced by
+   `tlskey`/`tlscert` (e.g. `openssl req -x509 -newkey rsa:2048 -nodes ...`).
+3. Run the launcher as root (it needs to write `/etc/nftables.conf` and run
+   `nft`); the web interface listens on `https://<server>:1969`.
+
+Note: upstream publishes the GUI only as a prebuilt tarball on
+nftablesbuilder.eu (served with a self-signed certificate, hence the
+`curlOpts = "-k"` in the derivation); the source repository is missing the
+`settings` crate, which this overlay patches in.
+
+
 ## Development
 
 ### Prerequisites