dixie: tether on :11435 in front of llama-server

Pin kyle/tether at c89894b. Listen 0.0.0.0:11435, upstream
127.0.0.1:11434. Open 11435 on tailscale0 next to 11433/11434.

hw/dixie/default.nix

@@ -125,6 +125,7 @@ in
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix
+    inputs.tether.nixosModules.tether
   ];
 
   config = {
@@ -188,15 +189,21 @@ in
       port = 11433; preset = visionModelsIni; modelsMax = 1;
     };
 
+    services.tether = {
+      enable = true;
+      listen = "0.0.0.0:11435";
+      upstream = "http://127.0.0.1:11434";
+    };
+
     # Wi-Fi only host. NetworkManager comes from the base config; the AX9L (mt7921u) becomes
     # the primary once plugged in and the internal CNVi radio stays as fallback. Connection
     # profiles are copied from the live-USB session at install time (see the install notes),
     # not stored in this repo.
     networking.networkmanager.wifi.backend = "wpa_supplicant";
 
-    # Reachable only over the tailnet: 11434 (router) and 11433 (vision) on tailscale0, and
-    # SSH from the LAN (base config opens 22) for bring-up.
-    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11433 11434 ];
+    # Reachable only over the tailnet: 11434 (router), 11433 (vision), 11435 (tether)
+    # on tailscale0, and SSH from the LAN (base config opens 22) for bring-up.
+    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11433 11434 11435 ];
 
     environment.systemPackages = with pkgs; [
       llama-cpp