Implement XDP firewall with real-time TUI monitoring

Features:
- High-performance packet filtering via eBPF/XDP
- Instant blocklist with dynamic CLI management
- Exact-match rules with Drop/Pass/Log actions
- CIDR-based IP range dropping via LPM trie
- Token-bucket rate limiting (IP-based and flow-based)
- Auto temp bans for rate limit violators
- Real-time event logging via BPF ring buffer
- Interactive TUI monitor with live stats

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

xdp-firewall/src/stats.rs

@@ -0,0 +1,15 @@
+use xdp_firewall_common::Stats;
+
+pub struct Rate {
+    pub pps: u64,
+    pub bps: u64,
+}
+
+pub fn compute_rate(now: Stats, last: Stats, elapsed_secs: f64) -> Rate {
+    let pkts = now.packets.saturating_sub(last.packets);
+    let bytes = now.bytes.saturating_sub(last.bytes);
+    Rate {
+        pps: (pkts as f64 / elapsed_secs) as u64,
+        bps: (bytes as f64 / elapsed_secs) as u64,
+    }
+}