Update Harbor client and gateway functionality

test/server/gateway-presence.test.js

@@ -136,10 +136,17 @@ test('verified Gateway stays active through transient discovery failures', () =>
 });
 
 test('canonical route distinguishes fresh, stale, lost, disabled and local states', () => {
+  const desiredRules = [
+    { type: 'domain', value: 'api.example.com', enabled: true, outbound: 'vpn' },
+    { type: 'domain_suffix', value: 'example.com', enabled: true, outbound: 'direct' },
+  ];
+  const appliedRules = [...desiredRules].reverse();
   const storedState = {
     revision: 1,
     subscriptionUrl,
     gatewayAutoEnabled: true,
+    routeRules: desiredRules,
+    appliedRouteRules: appliedRules,
   };
   const snapshot = (gatewayAuto, stored = storedState) => createStateSnapshot({
     storedState: stored,
@@ -167,10 +174,17 @@ test('canonical route distinguishes fresh, stale, lost, disabled and local state
   assert.equal(found.lastVerifiedAt, '2026-07-13T11:59:59.000Z');
   assert.equal(found.autoEnabled, true);
   assert.equal(found.fallbackPreference, 'local-vpn');
+  assert.equal(found.rulesContractVersion, 2);
+  assert.deepEqual(found.localRules, desiredRules);
+  assert.deepEqual(found.activeLocalRules, []);
+  assert.equal(found.localRulesPendingRestart, false);
   assert.equal(snapshot({ ...fresh, failures: 1 }).reason, 'gateway-stale');
   assert.equal(snapshot({ ...fresh, mode: 'local-vpn', gatewayId: '', lastError: 'lost' }).reason, 'gateway-lost');
   assert.equal(snapshot(fresh, { ...storedState, gatewayAutoEnabled: false }).reason, 'disabled');
-  assert.equal(snapshot(createGatewayAutoState()).reason, 'local');
+  const local = snapshot(createGatewayAutoState());
+  assert.equal(local.reason, 'local');
+  assert.deepEqual(local.activeLocalRules, appliedRules);
+  assert.equal(local.localRulesPendingRestart, true);
 });
 
 test('client can ignore and restore a verified Gateway without losing discovery', () => {