feat(waf): complete composable rule orchestration

Add the React Flow rule editor, ordered graph APIs and runtime DAG execution.\n\nPublish rules only on OpenResty reload and reconcile checksum-driven IP group snapshots in bounded shared memory.

pkg/protocol/waf_ip_group_snapshot.go

@@ -0,0 +1,39 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package protocol
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// MaxWAFIPGroupSnapshotBytes is the maximum serialized size accepted for the
+// complete Agent/OpenResty WAF IP group runtime document.
+const MaxWAFIPGroupSnapshotBytes = 20 << 20
+
+type wafIPGroupSnapshot struct {
+	Groups map[string]WAFIPGroup `json:"groups"`
+}
+
+// MarshalWAFIPGroupSnapshot serializes the exact document written by the
+// Agent to waf_ip_groups.json.
+func MarshalWAFIPGroupSnapshot(groups map[string]WAFIPGroup) ([]byte, error) {
+	if groups == nil {
+		groups = map[string]WAFIPGroup{}
+	}
+	return json.Marshal(wafIPGroupSnapshot{Groups: groups})
+}
+
+// ValidateWAFIPGroupSnapshotSize rejects a complete runtime document that
+// cannot be published safely to the OpenResty shared-memory snapshot.
+func ValidateWAFIPGroupSnapshotSize(groups map[string]WAFIPGroup) error {
+	data, err := MarshalWAFIPGroupSnapshot(groups)
+	if err != nil {
+		return err
+	}
+	if len(data) > MaxWAFIPGroupSnapshotBytes {
+		return fmt.Errorf("WAF IP 组快照大小 %d 字节超过上限 %d 字节", len(data), MaxWAFIPGroupSnapshotBytes)
+	}
+	return nil
+}