Firewall-NAT/Filter-Regeln beim Wizard-Apply idempotent machen

Wiederholter Wizard-Lauf gegen einen bereits konfigurierten Router hat
bisher jedes Mal dieselben NAT-/Filter-Regeln erneut angelegt (RouterOS
lehnt Duplikate hier nicht ab). SetupViewModel.apply holt jetzt einmalig
eine Live-Momentaufnahme der bestehenden Regeln und überspringt geplante
.add-Befehle mit identischem Argument-Set (ohne das rein schreibseitige
place-before). Live bestätigt: zweimaliger Wizard-Lauf, Regelanzahl
blieb beim zweiten Mal unverändert.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

RouterOSAssistant/Features/Wizard/Steps/Setup/SetupViewModel.swift

@@ -275,6 +275,27 @@ final class SetupViewModel: ObservableObject {
         prepareDefaults(from: connectionService.interfaces)
     }
 
+    /// Firewall filter/NAT menus have no unique identifying field (name, interface, …) to retry
+    /// an `.add` as a `.set` against — unlike the menus in `retryAsSetMenuPaths` below, a rule is
+    /// only "the same rule" if its whole argument set matches. RouterOS itself happily accepts
+    /// identical filter/NAT rules added repeatedly (no error, no dedup) — live-observed: a
+    /// second full wizard run against an already-configured router just keeps appending the same
+    /// rules again. Checked once per `apply()` against a live snapshot (see `apply(credentials:)`),
+    /// not per-command, since fetching after every single add would make an already-configured
+    /// router's rules invisible to the check for rules added earlier in the same run.
+    private static let firewallRuleMenuPaths: Set<String> = ["/ip firewall filter", "/ip firewall nat"]
+
+    /// `RouterOSCommand.add(...)`'s `"place-before"` argument is a write-time positional
+    /// instruction (where to insert), not a stored RouterOS property — it never appears in
+    /// `fetchMenuItems`' parsed fields, so it must be excluded here, or the comparison would
+    /// spuriously fail on it for every single command.
+    private func isDuplicateFirewallRule(_ command: RouterOSCommand, in existingItems: [RouterOSMenuItem]) -> Bool {
+        let comparableArguments = command.arguments.filter { $0.key != "place-before" }
+        return existingItems.contains { item in
+            comparableArguments.allSatisfy { key, value in item.fields[key] == value }
+        }
+    }
+
     func apply(credentials: RouterOSCredentials) {
         isApplying = true
         applyError = nil
@@ -286,7 +307,23 @@ final class SetupViewModel: ObservableObject {
                 applyLog.append("Sichere aktuelle Konfiguration…")
                 _ = try await backupService.createBackup(for: credentials)
 
+                var existingFirewallItems: [String: [RouterOSMenuItem]] = [:]
+                if plannedCommands.contains(where: { Self.firewallRuleMenuPaths.contains($0.menuPath) }) {
+                    for menuPath in Self.firewallRuleMenuPaths {
+                        existingFirewallItems[menuPath] = try await connectionService.fetchMenuItems(
+                            menuPath: menuPath,
+                            restPath: menuPath == "/ip firewall filter" ? "ip/firewall/filter" : "ip/firewall/nat"
+                        )
+                    }
+                }
+
                 for command in plannedCommands {
+                    if case .add = command.operation,
+                       let existing = existingFirewallItems[command.menuPath],
+                       isDuplicateFirewallRule(command, in: existing) {
+                        applyLog.append("\(command.summary) — bereits vorhanden, übersprungen")
+                        continue
+                    }
                     applyLog.append(command.summary)
                     try await applyIdempotently(command)
                 }