netfilter: add counters/reset path — preserves rules

Previously '/reset' replaced the entire FilterTable (destructive).
Added '/counters/reset' that clears:
- chain_counters (per-chain packets/bytes)
- rule.match_count (per-rule match counts)
WITHOUT removing rules or resetting policies.

FilterTable gains reset_counters() method.

Usage:
  echo > /scheme/netfilter/reset           # wipe everything
  echo > /scheme/netfilter/counters/reset  # clear metrics only

Mirrors Linux 'iptables -Z' (zero counters) vs full flush.

netstack/src/filter/table.rs

@@ -180,6 +180,18 @@ impl FilterTable {
     pub fn set_default_policy(&mut self, hook: Hook, verdict: Verdict) {
         self.default_policy.insert(hook, verdict);
     }
+
+    /// Clear per-chain counters and per-rule match counts.
+    /// Rules themselves are preserved. Use this to restart metrics
+    /// without losing configuration.
+    pub fn reset_counters(&mut self) {
+        for counter in self.chain_counters.values_mut() {
+            *counter = (0, 0);
+        }
+        for rule in &mut self.rules {
+            rule.match_count = 0;
+        }
+    }
 }
 
 fn format_rule(rule: &FilterRule) -> String {

netstack/src/scheme/netfilter.rs

@@ -282,6 +282,9 @@ impl NetFilterFile {
         } else if path == "/reset" {
             *table = FilterTable::new();
             log::info!("netfilter: table reset to defaults");
+        } else if path == "/counters/reset" {
+            table.reset_counters();
+            log::info!("netfilter: counters reset (rules preserved)");
         } else if let Some(rest) = path.strip_prefix("/policy/") {
             let hook = parse_hook_name(rest).ok_or(SyscallError::new(syscall::EINVAL))?;
             let verdict = match line.to_uppercase().as_str() {