router: allow docker0 forward and expose 7dtd-coop ports

Container outbound (image pulls, LinuxGSM bootstrap fetches) was
dropped by the inet filter forward chain — only eth0 and DNAT'd
WAN traffic were whitelisted. Add iifname "docker0" accept so
containers can reach the internet.

Also add the coop server's 26910/26911-26912 forwards to ports.toml
so WAN players can connect.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

services/router.nix

@@ -126,6 +126,8 @@ in
             ct state invalid drop
             # LAN → anywhere
             iifname "eth0" accept
+            # Docker containers → anywhere (needed for image pulls, LinuxGSM bootstrap, etc.)
+            iifname "docker0" accept
             # WAN → LAN only if it was DNAT'd by a port-forward rule
             iifname "eno1" oifname "eth0" ct status dnat accept
           }