Implement inbound mesh port forwarding

Mesh peers can now reach a configured host:port on the gateway's LAN
via static port-forward rules on fips-gateway. Mirror of the outbound
LAN gateway (IDEA-0079 / TASK-2026-0056).

Config: new gateway.port_forwards list of { listen_port, proto,
target } entries. Targets are SocketAddrV6 — IPv4 is rejected at
parse time. Validation rejects zero listen ports and duplicate
(listen_port, proto) pairs.

NAT: NatManager gains a port_forwards field and set_port_forwards()
setter, rebuilt in the same atomic rustables batch as the address
mappings. Each forward emits a prerouting DNAT rule keyed on
(iifname fips0, nfproto ipv6, l4proto, tcp/udp dport) that rewrites
destination address and port via Nat::with_ip_register +
with_port_register. When any forwards are configured, a single
LAN-side masquerade is installed on (iifname fips0, oifname
lan_interface, nfproto ipv6) so the LAN host sees the gateway as
source and replies flow back through conntrack. This rule is
distinct from the existing oifname fips0 masquerade that serves the
outbound pool.

Binary: fips-gateway validates port_forwards at startup and calls
set_port_forwards after NatManager construction; startup failure
cleans up the nftables table before exiting.

Test: extend testing/static/scripts/gateway-test.sh with Phase 7
that runs a marker HTTP server on the LAN-side client (fd02::20:8080)
and, from the mesh peer, curls the gateway's fips0 address on port
18080 to exercise the full DNAT + LAN masquerade path. The
LAN-side HTTP server is started with 'docker exec -d' plus a
bind-ready poll on ss; 'docker exec bash -c "cmd &"' does not
keep the child alive past the exec session even with nohup.

Test-infra: ci-local.sh now builds/clippies/tests with
--features gateway, matching GitHub CI. Without this the release
fips-gateway binary silently stays stale across runs, since
cargo build --release alone does not compile the gateway bin.

Verified locally: cargo test --features gateway --lib (991 pass),
clippy + fmt clean, full testing/ci-local.sh green (21/21 suites
in 8m36s, including the new gateway Phase 7).

testing/static/scripts/gateway-test.sh

@@ -44,12 +44,21 @@ with open('$config_file') as f:
 cfg['gateway'] = {
     'enabled': True,
     'pool': 'fd01::/112',
-    'lan_interface': 'eth0',
+    # Docker assigns gateway-lan to eth1 (fips-net is eth0). The
+    # LAN-side masquerade for inbound port forwards gates on this.
+    'lan_interface': 'eth1',
     'dns': {
         'listen': '[::]:53',
         'ttl': 5,
     },
     'pool_grace_period': 5,
+    'port_forwards': [
+        {
+            'listen_port': 18080,
+            'proto': 'tcp',
+            'target': '[fd02::20]:8080',
+        },
+    ],
 }
 
 with open('$config_file', 'w') as f:
@@ -163,9 +172,62 @@ else
     check "nftables DNAT rules" 1
 fi
 
-# Phase 7: TTL expiration and pool reclamation
+# Phase 7: Inbound port forwarding (TASK-2026-0061)
+#
+# Mesh peer (gw-server) → gw-gateway fips0:18080 → DNAT → [fd02::20]:8080
+# (gw-client LAN HTTP server). Exercises the DNAT rule + LAN-side
+# masquerade installed by set_port_forwards().
 echo ""
-echo "Phase 7: TTL expiration and pool reclamation"
+echo "Phase 7: Inbound port forward"
+
+# Confirm the port-forward DNAT rule is present on the gateway. The
+# distinctive listen port (18080) identifies our rule regardless of how
+# nft renders the l4proto/dport predicates.
+if echo "$NFT_RULES" | grep -q "18080"; then
+    check "nftables port-forward DNAT rule (tcp 18080)" 0
+else
+    check "nftables port-forward DNAT rule (tcp 18080)" 1
+fi
+
+# Start a marker HTTP server on the LAN-side client (fd02::20:8080).
+# `docker exec -d` is required; `docker exec bash -c 'cmd &'` doesn't
+# keep the child alive past the exec session, even with nohup.
+docker exec "$CLIENT" sh -c \
+    'mkdir -p /tmp/inbound && echo "inbound-forward-ok" > /tmp/inbound/index.html && pkill -f "http.server 8080" 2>/dev/null || true' \
+    >/dev/null 2>&1 || true
+docker exec -d "$CLIENT" python3 -m http.server 8080 --bind :: --directory /tmp/inbound \
+    >/dev/null 2>&1 || true
+# Give the server a moment to bind.
+for _ in 1 2 3 4 5; do
+    if docker exec "$CLIENT" ss -6lnt 2>/dev/null | grep -q ':8080'; then
+        break
+    fi
+    sleep 1
+done
+
+# Derive the gateway's mesh IPv6 (fd00::/8 address assigned to fips0).
+GW_MESH_IP=$(docker exec "$GATEWAY" bash -c \
+    "ip -6 -o addr show fips0 | awk '/inet6 fd/ {print \$4}' | cut -d/ -f1 | head -1" \
+    2>/dev/null || echo "")
+
+if [ -z "$GW_MESH_IP" ]; then
+    check "Gateway fips0 IPv6 address" 1
+else
+    echo "  Gateway mesh IPv6: $GW_MESH_IP"
+
+    # From the mesh side (gw-server), fetch through the forward rule.
+    FWD_RESPONSE=$(docker exec "$SERVER" curl -6 -s --max-time 10 \
+        "http://[${GW_MESH_IP}]:18080/" 2>&1) || true
+    if echo "$FWD_RESPONSE" | grep -q "inbound-forward-ok"; then
+        check "Inbound HTTP via port forward 18080 → [fd02::20]:8080" 0
+    else
+        check "Inbound HTTP via port forward (response: '${FWD_RESPONSE:0:80}')" 1
+    fi
+fi
+
+# Phase 8: TTL expiration and pool reclamation
+echo ""
+echo "Phase 8: TTL expiration and pool reclamation"
 # Flush conntrack so stale sessions from Phase 5 don't keep the mapping alive.
 docker exec "$GATEWAY" conntrack -F 2>/dev/null || true
 # Config uses ttl=5, pool_grace_period=5. Pool tick interval is 10s, so:
@@ -185,9 +247,9 @@ else
     check "Mapping reclaimed (count: $MAPPING_COUNT)" 1
 fi
 
-# Phase 8: SERVFAIL when daemon DNS is down
+# Phase 9: SERVFAIL when daemon DNS is down
 echo ""
-echo "Phase 8: SERVFAIL when daemon DNS is down"
+echo "Phase 9: SERVFAIL when daemon DNS is down"
 # Kill the fips daemon inside the gateway container (gateway stays running)
 docker exec "$GATEWAY" pkill -f "^fips --config" 2>/dev/null || true
 sleep 2
@@ -201,9 +263,9 @@ else
     check "SERVFAIL when daemon DNS down (got: '${SERVFAIL_RESULT:0:80}')" 1
 fi
 
-# Phase 9: Cleanup verification (nftables removed on shutdown)
+# Phase 10: Cleanup verification (nftables removed on shutdown)
 echo ""
-echo "Phase 9: Cleanup on shutdown"
+echo "Phase 10: Cleanup on shutdown"
 # fips-gateway is PID 1 (exec in entrypoint), so SIGTERM stops the container.
 # Verify cleanup by checking container logs for the shutdown sequence.
 docker stop --time=10 "$GATEWAY" >/dev/null 2>&1 || true