fix(firewall): remove blanket TCP allow for unpaid clientsfeature/tollgate-core-v2

The sandbox_mint_access=true default allowed ALL TCP forwarding from
unpaid clients, completely bypassing the firewall. Fix:
- Remove the blanket TCP allow when sandbox_mint_access is set
- Only allow traffic to AP IP on specific ports (80, 2121, 4869, mining)
- Allow ICMP to AP IP for diagnostics
- Default sandbox_mint_access to false
- Add port 4869 (local relay) to allowed sandbox ports

Verified on Board B: unpaid clients blocked from internet, local
services (portal, API, relay) still accessible.

1 files changed, 1 insertions, 1 deletions

diff --git a/main/config.c b/main/config.c
index 2edb6da..d2c40d6 100644
--- a/main/config.c
+++ b/main/config.c
@@ -45,7 +45,7 @@ esp_err_t tollgate_config_init(void)
     g_config.mining_payout_mode = MINING_PAYOUT_AUTO;
     g_config.stratum_port = 3333;
     g_config.mining_port = 3334;
-    g_config.mining_sandbox_mint_access = true;
+    g_config.mining_sandbox_mint_access = false;
     g_config.market_enabled = true;
     g_config.market_scan_interval_s = 30;
     g_config.client_auto_switch = false;