Add configurable VPN access policies (#1505)

## Summary

- add independent install options for internet routing, client-to-client
access, and explicit server-side networks
- enforce the selected policy across firewalld, nftables, and iptables,
including DCO traffic
- use destination-scoped NAT for home LAN access and preserve client
routes and DNS in split-tunnel mode
- document the new defaults and add focused Docker policy coverage

Defaults remain internet access enabled, client-to-client access
disabled, and server-side network access disabled.


Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213
#147

test/policy-peer-entrypoint.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+set -e
+
+WAIT_TIMEOUT="${WAIT_TIMEOUT:-120}"
+elapsed=0
+
+while [ ! -f /shared/policy-peer.ovpn ]; do
+	if [ "$elapsed" -ge "$WAIT_TIMEOUT" ]; then
+		echo "FAIL: Timed out waiting for peer client configuration"
+		exit 1
+	fi
+	echo "Waiting for peer client configuration... (${elapsed}/${WAIT_TIMEOUT}s)"
+	sleep 2
+	elapsed=$((elapsed + 2))
+done
+
+openvpn --config /shared/policy-peer.ovpn --daemon --log /var/log/openvpn-policy-peer.log
+
+elapsed=0
+until ip -4 addr show tun0 2>/dev/null | grep -q 'inet '; do
+	if [ "$elapsed" -ge "$WAIT_TIMEOUT" ]; then
+		echo "FAIL: Timed out waiting for peer VPN connection"
+		cat /var/log/openvpn-policy-peer.log 2>/dev/null || true
+		exit 1
+	fi
+	echo "Waiting for peer VPN connection... (${elapsed}/${WAIT_TIMEOUT}s)"
+	sleep 2
+	elapsed=$((elapsed + 2))
+done
+
+PEER_IP=$(ip -4 -o addr show tun0 | awk '{print $4}' | cut -d/ -f1)
+printf '%s\n' "$PEER_IP" >/shared/policy-peer-ip
+echo "Policy peer connected with VPN address $PEER_IP"
+
+exec tail -f /var/log/openvpn-policy-peer.log