Tier 0: render what the services already decided, honestly

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

config/dot/quickshell/services/Firewall.qml

@@ -154,6 +154,20 @@ Singleton {
     function addService(name: string): void { root.run(["add-service", name]); }
     function removePort(spec: string): void { root.run(["remove-port", spec]); }
     function addPort(spec: string): void { root.run(["add-port", spec]); }
+
+    // One press, one change. The open range a page shows as a single rule is
+    // usually two rules underneath -- Fedora's zone opens the high ports for
+    // tcp and for udp -- and a loop of removePort() calls would drop every
+    // iteration after the first on run()'s `mutation.running` guard, leaving
+    // half the range open under a confirmation that promised all of it. The
+    // helper takes the whole list, so it is one firewall-cmd invocation, one
+    // password prompt, and one snapshot afterwards.
+    function removePorts(specs: var): void {
+        const list = (specs ?? []).map(spec => String(spec)).filter(spec => spec !== "");
+        if (list.length === 0)
+            return;
+        root.run(["remove-port"].concat(list));
+    }
     function setZone(interfaceName: string, zoneName: string): void {
         root.run(["set-zone", interfaceName, zoneName]);
     }