restore: networking stack files from reflog (Phases 1-6)

Recovered from reflog commits 1c80937e and d0ecc067 after force-push data loss.
Includes: filter/, icmp_error.rs, slaac.rs, bond.rs, bridge.rs, gre.rs, ipip.rs,
qdisc.rs, tun.rs, vlan.rs, vxlan.rs, netfilter.rs, tun.rs, conntrack.rs, nat.rs,
rule.rs, table.rs, redbear-ufw/, dhcpv6d/, netdiag/ — 39 files total.

netstack/src/link/tun.rs

@@ -0,0 +1,73 @@
+//! TUN virtual network device — mirrors Linux 7.1's `drivers/net/tun.c`.
+//!
+//! The TUN device operates at layer 3 (IP), providing a virtual network
+//! interface that exchanges raw IP packets with a userspace program via
+//! the `scheme:tun` interface. This enables VPN software, custom routing
+//! daemons, and container networking.
+//!
+//! Linux reference: `tun_net_xmit()` (kernel→userspace) and
+//! `tun_get_user()` (userspace→kernel) in `drivers/net/tun.c`.
+
+use std::cell::RefCell;
+use std::collections::VecDeque;
+use std::rc::Rc;
+
+use smoltcp::time::Instant;
+use smoltcp::wire::{EthernetAddress, IpAddress, IpCidr};
+
+use super::LinkDevice;
+
+pub type PacketQueue = Rc<RefCell<VecDeque<Vec<u8>>>>;
+
+pub struct TunDevice {
+    name: Rc<str>,
+    rx_queue: PacketQueue,
+    tx_queue: PacketQueue,
+    recv_buffer: Vec<u8>,
+    ip_address: Option<IpCidr>,
+}
+
+impl TunDevice {
+    pub fn new(name: &str, rx: PacketQueue, tx: PacketQueue) -> Self {
+        Self {
+            name: name.into(),
+            rx_queue: rx,
+            tx_queue: tx,
+            recv_buffer: Vec::new(),
+            ip_address: None,
+        }
+    }
+}
+
+impl LinkDevice for TunDevice {
+    fn send(&mut self, _next_hop: IpAddress, packet: &[u8], _now: Instant) {
+        self.tx_queue.borrow_mut().push_back(packet.to_vec());
+    }
+
+    fn recv(&mut self, _now: Instant) -> Option<&[u8]> {
+        self.recv_buffer = self.rx_queue.borrow_mut().pop_front()?;
+        Some(&self.recv_buffer)
+    }
+
+    fn name(&self) -> &Rc<str> {
+        &self.name
+    }
+
+    fn can_recv(&self) -> bool {
+        !self.rx_queue.borrow().is_empty()
+    }
+
+    fn mac_address(&self) -> Option<EthernetAddress> {
+        None
+    }
+
+    fn set_mac_address(&mut self, _addr: EthernetAddress) {}
+
+    fn ip_address(&self) -> Option<IpCidr> {
+        self.ip_address
+    }
+
+    fn set_ip_address(&mut self, addr: IpCidr) {
+        self.ip_address = Some(addr);
+    }
+}