Add configurable VPN access policies (#1505)

## Summary

- add independent install options for internet routing, client-to-client
access, and explicit server-side networks
- enforce the selected policy across firewalld, nftables, and iptables,
including DCO traffic
- use destination-scoped NAT for home LAN access and preserve client
routes and DNS in split-tunnel mode
- document the new defaults and add focused Docker policy coverage

Defaults remain internet access enabled, client-to-client access
disabled, and server-side network access disabled.


Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213
#147

docker-compose.yml

@@ -14,6 +14,10 @@ services:
     cgroupns: host
     devices:
       - /dev/net/tun:/dev/net/tun
+    environment:
+      ROUTE_INTERNET: ${ROUTE_INTERNET:-y}
+      CLIENT_TO_CLIENT: ${CLIENT_TO_CLIENT:-n}
+      LOCAL_NETWORKS: ${LOCAL_NETWORKS:-}
     sysctls:
       - net.ipv4.ip_forward=1
     volumes: