Add PF synlimit backend

Implement synlimit = "pf" for PF-based firewalls using per-listener source tracking rules in a Telemt-owned anchor.

PF evaluates max-src-conn-rate through source tracking when creating
tates for completed TCP connections. Telemt installs a rate-limited pass
rule followed by a reject fallback rule in the listener anchor:

  - under-limit new connections create PF state and pass;
  - over-limit new connections fall through to block return-rst;
  - access resumes automatically when the source rate drops below the configured window.

Keep Linux iptables/nftables behavior unchanged.
PF maps synlimit_hitcount / synlimit_seconds to max-src-conn-rate and intentionally has
no direct equivalent for Linux-only burst/hashlimit knobs.

src/synlimit_control/command.rs

@@ -74,7 +74,7 @@ fn resolve_command(binary: &str) -> Option<PathBuf> {
         .find(|candidate| candidate.exists() && candidate.is_file())
 }
 
-pub(super) fn has_cap_net_admin() -> bool {
+pub(super) fn has_firewall_privileges() -> bool {
     #[cfg(target_os = "linux")]
     {
         let Ok(status) = std::fs::read_to_string("/proc/self/status") else {
@@ -91,7 +91,11 @@ pub(super) fn has_cap_net_admin() -> bool {
         }
         false
     }
-    #[cfg(not(target_os = "linux"))]
+    #[cfg(all(unix, not(target_os = "linux")))]
+    {
+        nix::unistd::Uid::effective().is_root()
+    }
+    #[cfg(not(unix))]
     {
         false
     }