mediaserver: add tcpdump and conntrack-tools

Router host had no packet-level diagnostics, so firewall rules
couldn't be verified against actual traffic.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/FredOS-Mediaserver.nix

@@ -11,6 +11,12 @@
       mergerfs
       wget
       util-linux
+      # This host is the router (services/router.nix) but shipped without any
+      # way to see a packet, so "is that nftables rule actually matching?" was
+      # unanswerable. Counters tell you a rule fired; these tell you what it
+      # fired on.
+      tcpdump
+      conntrack-tools
       javaPackages.compiler.temurin-bin.jre-25
       unzip
       screen