fix(amneziawg): let an emptied forwardedPorts withdraw a client's forwards

UpdateInboundClient carried the stored forwardedPorts forward whenever
the incoming value was empty, and Client.ForwardedPorts was a plain
omitempty string, so clearing the field in the client editor, as its
hint says to, reported success while the settings kept the old ports
and the host kept relaying them to the client's device.

The field is now a pointer, as KeepAlive is: nil (not sent) keeps the
stored spec and "" withdraws it. The client record follows the live
spec on every update, and a one-time seeder fills records that still
hold their creation value from the inbound settings, so the editor no
longer posts an empty field that would drop forwards added later.

internal/database/model/model_wireguard_test.go

@@ -16,6 +16,8 @@ func TestClientToRecordRoundTripWireGuard(t *testing.T) {
 		AllowedIPs:   []string{"10.0.0.2/32", "fd00::2/128"},
 		PreSharedKey: "cHNrLWJhc2U2NC0zMmJ5dGVzLXBsYWNlaG9sZGVyISE=",
 		KeepAlive:    KeepAlivePtr(25),
+
+		ForwardedPorts: ForwardedPortsPtr("80,8000-8100"),
 	}
 
 	rec := c.ToRecord()
@@ -32,6 +34,7 @@ func TestClientToRecordRoundTripWireGuard(t *testing.T) {
 		{"PublicKey", c.PublicKey, got.PublicKey},
 		{"PreSharedKey", c.PreSharedKey, got.PreSharedKey},
 		{"KeepAlive", c.KeepAliveSeconds(), got.KeepAliveSeconds()},
+		{"ForwardedPorts", c.ForwardedPortsSpec(), got.ForwardedPortsSpec()},
 	} {
 		if f.a != f.b {
 			t.Errorf("%s round-trip = %v, want %v", f.name, f.b, f.a)
@@ -59,6 +62,15 @@ func TestClientToClientOmitsUnsetKeepAlive(t *testing.T) {
 	}
 }
 
+// An explicit "" withdraws the forwards, which a re-saved record must never ask for.
+func TestClientToClientOmitsUnsetForwardedPorts(t *testing.T) {
+	rec := &ClientRecord{Email: "awg@example.test", Enable: true}
+
+	if got := rec.ToClient().ForwardedPorts; got != nil {
+		t.Fatalf("ForwardedPorts for a record that never set any = %q, want nil", *got)
+	}
+}
+
 func TestClientRecordEmptyAllowedIPs(t *testing.T) {
 	rec := &ClientRecord{Email: "bob@example.test", AllowedIPs: ""}
 	if got := rec.ToClient().AllowedIPs; got != nil {