nftables rules do not survive a reboot, and the generated config starts
with `delete table inet vpsmgr`, so on a fresh boot `nft -f` failed with
"no such file or directory" and the whole ruleset never loaded (no DNAT,
no port-25 block). The panel's fw.Reload already ensures the table first;
the boot unit did not.
ExecStart now runs `nft add table` before the batch, matching the panel
path. Verified across a real host reboot: vps-nft comes up clean, the
ruleset loads, and all containers keep working.
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
