Keep ROS traffic off the LAN; load the firewall at boot

DDS has no authentication, and /camera/* and /vision/faces carry video and
recognised names. Discovery now defaults to this machine only
(ROBOT_ROS_DISCOVERY=SUBNET to opt in; a ${VAR:-default} on ROS's own variable
never applied, since its setup script already exports SUBNET), and the firewall
drops domain 42's DDS ports on every interface but usb0 and loopback. The
detector's startup log prints a count of enrolled people, not their names.

robot-firewall.service loads the rules before networking at every boot: they had
only been loaded at runtime and were gone after each reboot, which has to be fixed
before the PipeWire network server opens port 4713.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs

pi/nftables-robot.nft

@@ -1,6 +1,9 @@
 #!/usr/sbin/nft -f
 # The robot's audio (4713), MCP (8765) and face webhook (8766) ports are reachable only over the
 # USB link, and only from the host at 10.55.0.1. Every other interface, Wi-Fi included, is dropped.
+# ROS 2's DDS has no authentication, and /camera/* and /vision/faces carry video and recognised
+# names, so its ports (domain 42: 17900-18149 with Fast DDS's default offsets) are dropped on every
+# interface but usb0 and loopback too.
 # SSH and everything else are left alone: that policy is the owner's call.
 
 table inet robot
@@ -12,5 +15,6 @@ table inet robot {
         iif "lo" accept
         iifname "usb0" ip saddr 10.55.0.1 tcp dport { 4713, 8765, 8766 } accept
         tcp dport { 4713, 8765, 8766 } drop
+        iifname != { "lo", "usb0" } udp dport 17900-18149 drop
     }
 }