Add PF synlimit backend

Implement synlimit = "pf" for PF-based firewalls using per-listener source tracking rules in a Telemt-owned anchor.

PF evaluates max-src-conn-rate through source tracking when creating
tates for completed TCP connections. Telemt installs a rate-limited pass
rule followed by a reject fallback rule in the listener anchor:

  - under-limit new connections create PF state and pass;
  - over-limit new connections fall through to block return-rst;
  - access resumes automatically when the source rate drops below the configured window.

Keep Linux iptables/nftables behavior unchanged.
PF maps synlimit_hitcount / synlimit_seconds to max-src-conn-rate and intentionally has
no direct equivalent for Linux-only burst/hashlimit knobs.

src/maestro/mod.rs

@@ -987,7 +987,9 @@ async fn run_telemt_core(
         std::process::exit(1);
     }
 
-    // On Unix, caller supplies privilege drop after bind (may require root for port < 1024).
+    synlimit_control::reconcile_synlimit_rules(&config).await;
+
+    // On Unix, caller supplies privilege drop after bind and privileged firewall setup.
     drop_after_bind();
 
     let synlimit_controller = synlimit_control::spawn_synlimit_controller(runtime_watch_rx);