conntrack: per-protocol and per-state statistics

ConntrackTable gains stats() method returning per-protocol breakdown:
  tcp_entries: N (est=N syn=N syn_recv=N fin=N tw=N close=N)
  udp_entries: N
  icmp_entries: N
  over_limit: N
  total_entries: N

TCP states counted: None, SynSent, SynRecv, Established, FinWait,
TimeWait, Close. Mirrors Linux /proc/net/stat/nf_conntrack.

Exposed via three channels:
- /scheme/netfilter/conntrack/stats  (new dedicated node)
- /scheme/netfilter/stats (existing, now includes per-state)
- /scheme/netcfg/summary (includes conntrack stats block)

All 31 tests pass.

netstack/src/filter/conntrack.rs

@@ -440,6 +440,55 @@ impl ConntrackTable {
         self.entries.len()
     }
 
+    /// Per-protocol and per-state connection breakdown.
+    /// Returns lines like:
+    ///   tcp_entries: N (est=N syn=N syn_recv=N fin=N tw=N close=N)
+    ///   udp_entries: N
+    ///   icmp_entries: N
+    ///   over_limit: N
+    ///   total_entries: N
+    pub fn stats(&self) -> alloc::string::String {
+        let mut tcp = 0u32;
+        let mut tcp_est = 0u32;
+        let mut tcp_syn = 0u32;
+        let mut tcp_syn_recv = 0u32;
+        let mut tcp_fin = 0u32;
+        let mut tcp_tw = 0u32;
+        let mut tcp_close = 0u32;
+        let mut udp = 0u32;
+        let mut icmp = 0u32;
+
+        for entry in self.entries.values() {
+            match entry.key.l4proto {
+                6 => {
+                    tcp += 1;
+                    match entry.tcp_state {
+                        TcpTracking::None => {}
+                        TcpTracking::SynSent => tcp_syn += 1,
+                        TcpTracking::SynRecv => tcp_syn_recv += 1,
+                        TcpTracking::Established => tcp_est += 1,
+                        TcpTracking::FinWait => tcp_fin += 1,
+                        TcpTracking::TimeWait => tcp_tw += 1,
+                        TcpTracking::Close => tcp_close += 1,
+                    }
+                }
+                17 => udp += 1,
+                1 | 58 => icmp += 1,
+                _ => {}
+            }
+        }
+
+        let mut out = alloc::format!(
+            "tcp_entries: {} (est={} syn={} syn_recv={} fin={} tw={} close={})\n",
+            tcp, tcp_est, tcp_syn, tcp_syn_recv, tcp_fin, tcp_tw, tcp_close
+        );
+        out.push_str(&alloc::format!("udp_entries: {}\n", udp));
+        out.push_str(&alloc::format!("icmp_entries: {}\n", icmp));
+        out.push_str(&alloc::format!("over_limit: {}\n", self.over_limit_count));
+        out.push_str(&alloc::format!("total_entries: {}\n", self.entries.len()));
+        out
+    }
+
     fn check_syn_limit(&mut self, src: IpAddress, now: Instant) -> bool {
         const SYN_LIMIT: u32 = 100;
         const SYN_WINDOW: Duration = Duration::from_secs(1);