feat(network): use Tailnet identities and guarded host firewall

host-init.sh

@@ -5,7 +5,7 @@ export LC_ALL=C
 fail() { printf 'ERROR: %s\n' "$*" >&2; return 1; }
 ensure_baseline_packages() {
   local package missing=()
-  for package in ca-certificates curl jq git openssl openssh-client iproute2; do
+  for package in ca-certificates curl jq git openssl openssh-client iproute2 nftables; do
     if [[ $(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null) != installed ]]; then
       missing+=("$package")
     fi