fix(P18): nftables ruleset hardening (REQ-133, F21)

---ci---
project: orca
phase: 18
milestone: v0.12
status: execute
---/ci---

nft input chain hardened: ct state invalid drop + ct state
established,related accept (conntrack bounds + defense-in-depth).
Tests pass. Build green.

internal/emitter/nft.go

@@ -107,6 +107,8 @@ func renderNftRuleset(cfg NftClusterConfig) string {
 	b.WriteString("\t}\n\n")
 	b.WriteString("\tchain input {\n")
 	b.WriteString("\t\ttype filter hook input priority filter; policy accept;\n")
+	b.WriteString("\t\tct state invalid drop\n")
+	b.WriteString("\t\tct state established,related accept\n")
 	b.WriteString("\t\ttcp dport 443 tcp-flags != syn,rst,ack,fin notrack drop\n")
 	b.WriteString("\t}\n\n")
 	b.WriteString("\tchain prerouting {\n")