feat(firewall): add audited rule lifecycle management

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Unit/Controllers/FirewallControllerTest.php

@@ -123,6 +123,44 @@ final class FirewallControllerTest extends TestCase
         self::assertSame('invalid_firewall_rule', $data['error']['code']);
     }
 
+    #[TestDox('Re-enabling a current-IP block requires explicit confirmation')]
+    public function testEnableSafeguard(): void
+    {
+        $rule = (new \KTXC\Models\Firewall\FirewallRuleObject())
+            ->setId('rule-123')
+            ->setScope('tenant')
+            ->setTenantId('tenant-a')
+            ->setType('ip')
+            ->setAction('block')
+            ->setValue('203.0.113.10')
+            ->setEnabled(false);
+        $this->store->method('fetchRule')->willReturn($rule);
+
+        $response = $this->controller->updateTenantRule(
+            new Request(server: ['REMOTE_ADDR' => '203.0.113.10']),
+            'rule-123',
+            'enable',
+            'Threat returned'
+        );
+        $data = json_decode($response->getContent(), true, flags: JSON_THROW_ON_ERROR);
+
+        self::assertSame(409, $response->getStatusCode());
+        self::assertSame('current_ip_confirmation_required', $data['error']['code']);
+    }
+
+    #[TestDox('Lifecycle endpoints return stable validation and not-found responses')]
+    public function testLifecycleResponses(): void
+    {
+        $request = new Request(server: ['REMOTE_ADDR' => '203.0.113.10']);
+
+        self::assertSame(400, $this->controller->updateSystemRule(
+            $request, 'rule-123', 'extend', 'More time required'
+        )->getStatusCode());
+        self::assertSame(404, $this->controller->deleteTenantRule(
+            'missing-rule', 'No longer required'
+        )->getStatusCode());
+    }
+
     #[TestDox('Every rule endpoint declares its scope-specific read permission')]
     public function testRoutePermissions(): void
     {
@@ -140,6 +178,10 @@ final class FirewallControllerTest extends TestCase
             'maintenanceStatus' => SystemFirewallStatusService::PERMISSION_MAINTENANCE_READ,
             'createTenantRule' => TenantFirewallRuleService::PERMISSION_MANAGE,
             'createSystemRule' => SystemFirewallRuleService::PERMISSION_MANAGE,
+            'updateTenantRule' => TenantFirewallRuleService::PERMISSION_MANAGE,
+            'updateSystemRule' => SystemFirewallRuleService::PERMISSION_MANAGE,
+            'deleteTenantRule' => TenantFirewallRuleService::PERMISSION_MANAGE,
+            'deleteSystemRule' => SystemFirewallRuleService::PERMISSION_MANAGE,
         ];
 
         foreach ($expected as $method => $permission) {