- internal_interface (vmbr0): DNAT by destination for internal users
  accessing banned IPs on ports 80/443 → ban_server:82 (int2.py)
- IPv6: add ether3 DNAT, internal_interface DNAT by dst
- Fix duplicate for-loop bug in create_ip6tables_rules
- Add destroy rules for internal_interface (IPv4 + IPv6)
- Add TESTING.md with verification checklist