fix: add CONNMARK restore-mark to mangle OUTPUT chain

The CONNMARK --restore-mark rule was only in PREROUTING, which handles
forwarded packets. Locally-bound listeners (e.g. vhost) generate replies
through the OUTPUT chain, where the fwmark was never restored. This
caused response packets to route via the default table instead of back
through the originating interface.

web/projects/ui/src/app/services/api/embassy-mock-api.service.ts

@@ -497,13 +497,12 @@ export class MockApiService extends ApiService {
     return null
   }
 
-  async testPortForward(params: {
-    gateway: string
-    port: number
-  }): Promise<boolean> {
+  async checkPort(
+    params: T.CheckPortParams,
+  ): Promise<T.CheckPortRes> {
     await pauseFor(2000)
 
-    return false
+    return { ip: '0.0.0.0', port: params.port, reachable: false }
   }
 
   // marketplace URLs