summary: include filter chain counters via chain_summary()

netcfg/summary now threads the FilterTable through and calls
chain_summary() — surface per-chain packet/byte/policy counters.

Output now includes:
  filter chains:
  input: pkts=12 bytes=5678 policy=ACCEPT
  output: pkts=0 bytes=0 policy=ACCEPT
  forward: pkts=0 bytes=0 policy=ACCEPT
  prerouting: pkts=0 bytes=0 policy=ACCEPT
  postrouting: pkts=0 bytes=0 policy=ACCEPT

NetCfgScheme::new gains filter_table: Rc<RefCell<FilterTable>> param.
Smolnetd passes the existing filter_table Rc.

All 5 unit tests still pass — refactor preserves behavior.

netstack/src/scheme/mod.rs

@@ -197,6 +197,7 @@ impl Smolnetd {
                 Rc::clone(&socket_set),
                 ip_forward,
                 Rc::clone(&observer),
+                Rc::clone(&filter_table),
             )?,
             netfilter_scheme: NetFilterScheme::new(
                 netfilter_file,

netstack/src/scheme/netcfg/mod.rs

@@ -104,10 +104,11 @@ fn mk_root_node(
     socket_set: Rc<RefCell<SocketSet>>,
     ip_forward: Rc<Cell<bool>>,
     observer: ObserverRef,
+    filter_table: Rc<RefCell<crate::filter::FilterTable>>,
 ) -> CfgNodeRef {
     cfg_node! {
         "summary" => {
-            ro [devices, route_table, socket_set, ip_forward] || {
+            ro [devices, route_table, socket_set, ip_forward, filter_table] || {
                 let mut out = String::new();
                 let devs = devices.borrow();
                 let eth0 = devs.get("eth0");
@@ -137,6 +138,8 @@ fn mk_root_node(
                         s.rx_bytes, s.rx_packets, s.tx_bytes, s.tx_packets,
                         s.rx_errors, s.tx_errors, s.rx_dropped, s.tx_dropped));
                 }
+                out.push_str("filter chains:\n");
+                out.push_str(&filter_table.borrow().chain_summary());
                 out
             }
         },
@@ -804,6 +807,7 @@ impl NetCfgScheme {
         socket_set: Rc<RefCell<SocketSet>>,
         ip_forward: Rc<Cell<bool>>,
         observer: ObserverRef,
+        filter_table: Rc<RefCell<crate::filter::FilterTable>>,
     ) -> Result<NetCfgScheme> {
         let notifier = Notifier::new_ref();
         let dns_config = Rc::new(RefCell::new(DNSConfig {
@@ -822,6 +826,7 @@ impl NetCfgScheme {
                 socket_set,
                 ip_forward,
                 observer,
+                filter_table,
             ),
             notifier,
         };