Commons computer edge is moving to a Caddy LXC on pve (192.168.1.11);
the public 80/443 forwards follow shortly. The box firewall currently
only opens 22/80/443 on the wired interface, so the edge cannot reach
the 5555/5556/6555/3030 service ports. Allow them from the LAN only;
tailnet traffic already bypasses the firewall.
Follow-up PR: strip the public Caddy vhosts after the UDM flip.
