mediaserver: drop no-op firewall rules, close unused DR forwards

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/FredOS-Mediaserver.nix

@@ -43,8 +43,8 @@
       allowReboot = true;
     };
 
-    # Open firewall for SSH
-    networking.firewall.allowedTCPPorts = [ 22 11434 ];
+    # WAN exposure is controlled by nftables in services/router.nix +
+    # ports.toml (networking.firewall is disabled on this host).
     services.openssh = {
       enable = true;
       settings = {