networking: loose reverse-path filtering for tailscale exit nodes

Strict RPF (NixOS default) drops the encrypted return traffic of an active
exit node: table 52's 'default dev tailscale0' makes the reverse-path lookup
for packets arriving on the physical interface resolve to tailscale0, so they
are dropped before Tailscale decrypts them (rx stays 0). Loose RPF still blocks
spoofed/unroutable sources but removes the interface-match requirement, as
recommended by Tailscale/NixOS for exit nodes and subnet routers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/system/networking.nix

@@ -6,6 +6,7 @@
     nftables.enable = true;
     firewall = {
       enable = true;
+      checkReversePath = "loose";          # exit nodes/subnet routes need loose RPF
       trustedInterfaces = [ "tailscale0" ];
       allowedUDPPorts = [ config.services.tailscale.port ];
     };