port_forwarding: add source-zone selector for extra WAN VLANs

[ispyisail]

Summary

Task #9 from the WAN VLAN Manager plan: basic.js's WAN VLAN table (#33) lets a router have more than one WAN zone (default wan plus wan_vlan<N> for each additive VLAN row), but every port forward and open-port rule was still hardcoded to src='wan' -- there was no way to route a forward at a specific WAN VLAN (e.g. an ISP's separate IPTV or VoIP VLAN) instead of the primary connection.

Changes

• Each of the 4 rule tables (single-port forward, port-range forward, single-port open, port-range open) gets a Source Zone column, and a matching dropdown in its add/edit modal.
• The dropdown is populated client-side from uciOriginal's existing firewall zones (wan + any wan_vlan<N> zone) -- both firewall and network are already injected into this page, so no backend/haserl change was needed. Each VLAN zone shows its own description (network.wan_vlan<N>.gargoyle_desc) when set, e.g. "IPTV (wan_vlan20)".
• Zone is now part of a rule's identity for the multi-tab-safe save/reuse logic from port_forwarding: fix multi-tab save silently reverting other rules #27: buildRuleIndex()'s key gained the source zone, and every duplicate/overlap check (proofreadForward*/proofreadOpen*) plus the TCP+UDP merge check became zone-aware -- the same external port can now legitimately be forwarded on two different WAN zones without being flagged as a collision or silently merged into one row.
• Changing an existing rule's zone is treated as an identity change (old section retired, new one allocated) -- the same treatment the existing enabled/disabled toggle already got.

Test plan

• node --check passes
• New tests/known-devices/port-forwarding-zone.test.js (first jsdom harness for this page) -- 3/3 pass: an unedited wan_vlan10 rule emits zero commands; two rules sharing a port on different zones stay separate (no merge/collision); changing a rule's zone correctly retires the old section and allocates a new one with the updated src
• Full tests/known-devices/*.test.js suite -- 50/61 pass, same 8 pre-existing unrelated failures with/without this change (tracked separately, PR wifi: allow independent encryption and password per AP band lantis1008/gargoyle#62/wifi: allow independent encryption and password per AP band lantis1008/gargoyle#68 not yet merged), 2 todo, 1 skip
• Live verification against a real vnet router (site-a): seeded a wan_vlan20 zone plus two baseline forward rules (one per zone) via the real run_commands.sh endpoint; edited one zone's rule as "Tab A", edited the other zone's rule as a stale "Tab B" -- confirmed both edits landed with no cross-contamination and neither rule's zone was disturbed; added a 3rd rule reusing the same external port on the other zone and confirmed both coexist as separate sections
• New vnet/tests/29-multitab_corruption.test.sh T-MULTITAB-11 (companion gargoyle-tools commit) -- full phase 29 suite now 11/11

https://claude.ai/code/session_012xm1pavEAaQbR8Z5YoG8KX