fix_snmp reported success on APs where the rule never reached nftables.
Five defects stacked up:
1. Zone detection required ".src=" and "ssh" in the same `uci show` line.
UCI prints one option per line, so anonymous rules never matched and
every device fell through to the hardcoded "lan" fallback.
2. That fallback was never checked against the zones that actually exist.
On an AP whose zone section has no `option name`, fw4 skips the section,
so `src='lan'` referenced a zone that was not there and the rule was
dropped with it.
3. The "already present" guard was a substring test, so a rule written by
an earlier broken run was skipped forever instead of repaired.
4. Stale-rule deletion never committed — the only `uci commit firewall`
sat in the add branch that the guard had just skipped.
5. `fw4 reload` errors were swallowed by `|| true`, and with no local
snmpget the action hardcoded success = True.
Now: the management address comes from $SSH_CONNECTION and is mapped to
its network section (via ipaddr, or via `ip -o -4 addr` -> device when the
interface is DHCP-addressed) and from there to the owning zone. A zone
section without a name aborts the action with the repair command rather
than writing a dead rule — naming it is left to the operator, since an
inert zone becoming active changes what the AP filters. Rules are written
in full every run, stale ones are deleted highest anonymous index first
(uci renumbers @rule[n] on delete) and committed, reload output is no
longer truncated or ignored, and success is verified on the device via
`ss -lun` and a udp/161 lookup in the live ruleset.
Christian Manivong
597a59fa39