Automate firewall policies for multiple appliances

[lweberru]

Goal

Apply OPNsense policy configuration consistently to every firewall created through connectivity.firewalls.

Scope

• Replace the single-endpoint firewall_config contract with appliance- or network-area-keyed configuration.
• Manage bootstrap API credentials and Secrets Manager storage per appliance.
• Distribute aliases, rules, routes, outbound NAT, and port forwards to the matching appliance.
• Preserve the existing single-firewall configuration as a compatible default.
• Add complete multi-firewall examples and plan tests.

Acceptance criteria

• Each configured firewall can have an independent endpoint, credentials, and policy.
• Bootstrap credentials are stored and retrieved per firewall key.
• A policy is applied only to its matching appliance.
• Legacy single-firewall configurations keep their behavior.
• An executable plan test covers two firewall appliances.