firewall close: den Adminport des Proxy Managers mit anbieten

Der Adminport war als "noetig" eingestuft und blieb deshalb offen,
obwohl er gerade der Port ist, der im Netz nichts verloren hat. Die
Oberflaeche ist auch ueber 127.0.0.1 zu erreichen - per Terminal-Browser
im Container oder ueber einen SSH-Tunnel -, der Port ist also kein
Pflichtport. Er wird jetzt zum Schliessen angeboten, mit dem Hinweis,
was das bedeutet; --keep-admin laesst ihn offen, und in der Oberflaeche
wird gefragt, sobald er betroffen ist.

Welcher Port es ist, kommt aus NPM_ADMIN_PORT - wer auf 10443 verlegt
hat, bekommt 10443 angeboten. Die Vorgabe 81 steht zusaetzlich immer im
Katalog: nach einem Portwechsel bliebe sie sonst offen, ohne dass sie
noch jemand nennt. Genau dieser Fall - 81 und 10443 beide offen,
konfiguriert ist 10443 - ist der Testfall.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README_en.md

@@ -2012,6 +2012,28 @@ Three safeguards are built in:
 | **Foreign rules stay** | if you have 3306 open for your database, you keep it – only what this setup knows about is closed |
 | **Collective rules stay** | a rule like `80,443/tcp` covers several ports; it is reported instead of deleted |
 
+**The Proxy Manager's admin port is offered as well.** It is not a mandatory
+port: the interface is reachable through `127.0.0.1` too – via the terminal
+browser in the container or through an SSH tunnel. Exposed to the network it
+has no business being open, which is exactly why it is up for discussion here:
+
+```
+  PORT       GEHOERT ZU                                   ZUSTAND
+  10443/tcp  Adminoberflaeche des Proxy Managers          kann zu - Zugang dann nur lokal
+  81/tcp     Adminoberflaeche - alter Vorgabeport         kann zu
+```
+
+Which port that is comes from `NPM_ADMIN_PORT` – move it to 10443 and 10443 is
+what gets offered. The default **81 is always in the catalogue as well**: after
+moving the port it would otherwise stay open with nobody naming it any more. To
+keep admin access from the network:
+
+```bash
+sudo ./scripts/cmk-manage.sh firewall close --apply --keep-admin
+```
+
+The GUI asks about it as soon as an admin port is affected.
+
 With ufw the rules are deliberately **not** deleted by number: those shift on
 the first deletion, and the next call would hit the wrong rule. Deletion goes
 by rule specification instead (`ufw delete allow 514/udp`), with nftables by
@@ -2285,7 +2307,7 @@ A file chooser with directory navigation is built in.
 | `npm-reset` | move the database aside so the account is recreated |
 | `proxy status\|list\|certs\|add\|del` | create and manage proxy hosts through the API |
 | `cert …` | create a self-signed certificate |
-| `firewall [check\|open\|close]` | check, open, and close again what is no longer needed (firewalld, ufw, nftables, iptables) |
+| `firewall [check\|open\|close]` | check, open, and close again what is no longer needed (firewalld, ufw, nftables, iptables); `close --keep-admin` keeps the admin port open |
 | `shell` | root shell in the Checkmk container |
 | `omd …` | any `omd` command inside the container |