docs: document Proxmox write permissions and firewall apply scope, add live apply implementation with rule resolution and provider integration

Add minimum write privileges section covering VM.Audit and VM.Config.Network requirements for firewall orchestration, document NexaFabric comment marker approach for safe rule replacement, clarify that only VM/LXC-level rules with concrete workload targets are supported for live apply while security groups remain preview-only, add firewall interface checkbox requirement for enforcement, document

backend/app/services/providers/proxmox.py

@@ -127,11 +127,89 @@ class ProxmoxProvider(Provider):
             "warnings": ["Preview only. No Proxmox firewall changes were sent."],
         }
 
+    def firewall_rules_url(self, connection: ProviderConnection, target: dict[str, Any]) -> str:
+        kind = "lxc" if target.get("kind") == "lxc" else "qemu"
+        node = target["node"]
+        vmid = target["vmid"]
+        return f"{connection.api_url.rstrip('/')}/api2/json/nodes/{node}/{kind}/{vmid}/firewall/rules"
+
+    def policy_marker(self, rule: dict[str, Any]) -> str:
+        return f"NexaFabric policy={rule.get('policy_id')}"
+
+    async def delete_existing_policy_rules(
+        self,
+        client: httpx.AsyncClient,
+        headers: dict[str, str],
+        rules_url: str,
+        marker: str,
+    ) -> list[dict[str, Any]]:
+        existing_response = await client.get(rules_url, headers=headers)
+        existing_response.raise_for_status()
+        existing_rules = existing_response.json().get("data", [])
+        deletions = []
+        for existing_rule in sorted(existing_rules, key=lambda item: int(item.get("pos", 0)), reverse=True):
+            comment = str(existing_rule.get("comment") or "")
+            pos = existing_rule.get("pos")
+            if marker in comment and pos is not None:
+                delete_response = await client.delete(f"{rules_url}/{pos}", headers=headers)
+                delete_response.raise_for_status()
+                deletions.append({"pos": pos, "comment": comment})
+        return deletions
+
     async def apply_rules(self, connection: ProviderConnection, rules: list[dict[str, Any]]) -> dict[str, Any]:
         if connection.read_only:
             return {"applied": False, "reason": "Cluster is read-only", "rules": rules}
+        missing_mapping = [rule for rule in rules if "provider_target" not in rule]
+        if missing_mapping:
+            return {
+                "applied": False,
+                "reason": "Live apply requires every rule to resolve to a concrete Proxmox VM/LXC target.",
+                "rules": missing_mapping,
+            }
+
+        headers = {"Authorization": self.auth_header(connection.token)}
+        grouped: dict[tuple[str, str, str, str], list[dict[str, Any]]] = {}
+        for rule in rules:
+            target = rule["provider_target"]
+            marker = self.policy_marker(rule)
+            key = (str(target["node"]), str(target["kind"]), str(target["vmid"]), marker)
+            grouped.setdefault(key, []).append(rule)
+
+        applied_rules = []
+        deleted_rules = []
+        audit_only_rules = []
+        async with httpx.AsyncClient(verify=connection.verify_tls, timeout=20) as client:
+            for target_rules in grouped.values():
+                target = target_rules[0]["provider_target"]
+                rules_url = self.firewall_rules_url(connection, target)
+                marker = self.policy_marker(target_rules[0])
+                deleted_rules.extend(await self.delete_existing_policy_rules(client, headers, rules_url, marker))
+
+                for rule in target_rules:
+                    if rule.get("audit_only"):
+                        audit_only_rules.append(
+                            {
+                                "policy_id": rule.get("policy_id"),
+                                "target": target,
+                                "reason": "Audit mode does not enforce or write blocking Proxmox rules.",
+                            }
+                        )
+                        continue
+                    provider_rule = rule.get("provider_rule")
+                    if not provider_rule:
+                        return {
+                            "applied": False,
+                            "reason": "Resolved rule is missing provider_rule payload.",
+                            "rule": rule,
+                        }
+                    create_response = await client.post(rules_url, headers=headers, data=provider_rule)
+                    create_response.raise_for_status()
+                    applied_rules.append({"target": target, "rule": provider_rule, "result": create_response.json().get("data")})
+
         return {
-            "applied": False,
-            "reason": "Live Proxmox firewall apply needs rule-to-VM mapping before NexaFabric can safely write provider rules.",
-            "rules": rules,
+            "applied": True,
+            "rules_written": len(applied_rules),
+            "rules_deleted": len(deleted_rules),
+            "audit_only": audit_only_rules,
+            "rules": applied_rules,
         }