go2rtc: bind to loopback; isolate the camera from routing

The go2rtc API is unauthenticated and echoes producer URLs, so
GET /api/streams handed out the camera's RTSP password to anything
on the LAN. Bind api/rtsp/webrtc to 127.0.0.1 and add an `isolated`
device flag that drops the camera in the forward chain.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/router.nix

@@ -37,6 +37,25 @@ let
     (d: ''iifname "eth0" ether saddr ${d.mac} drop comment "${d.name} blocked"'')
     blockedDevices;
 
+  isolatedDevices = builtins.filter (d: d.isolated or false) devices;
+
+  # Forward-chain-only drop: the device may still talk to the router itself,
+  # but the router will not carry its traffic anywhere. For the IP camera that
+  # means go2rtc keeps pulling RTSP (router is the endpoint, so that path never
+  # reaches the forward hook) while the camera loses the internet and every
+  # other LAN host — the isolation a separate VLAN would have given us.
+  #
+  # Emitted at the TOP of the forward chain for the same reason blockRules are:
+  # placed after `ct state established,related accept`, an already-open session
+  # to the vendor cloud would survive indefinitely.
+  #
+  # ponytail: MAC-based like blockRules, so it inherits the same weakness — a
+  # device that randomises its MAC walks around it. Fine for an IP camera,
+  # which won't; match on the DHCP-reserved IP too if that ever changes.
+  isolateRules = lib.concatMapStringsSep "\n            "
+    (d: ''iifname "eth0" ether saddr ${d.mac} drop comment "${d.name} isolated (no routing)"'')
+    isolatedDevices;
+
   # Phase-1 transition list; empty now that eero is in bridge mode and
   # eno1 is strictly the ISP-facing WAN.
   trustedLegacyCidrs = [ ];
@@ -187,8 +206,9 @@ in
           }
           chain forward {
             type filter hook forward priority 0; policy drop;
-            # Blocked devices first — before the conntrack accept.
+            # Blocked and isolated devices first — before the conntrack accept.
             ${blockRules}
+            ${isolateRules}
             ct state established,related accept
             ct state invalid drop
             # LAN → anywhere