fix(netdata): add firewall rule for direct Tailscale access

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/netdata.nix

@@ -53,6 +53,11 @@ in
       internalOnly = true;
       contentSecurityPolicy = null;  # Netdata dashboard has its own CSP requirements, cannot be overridden
     };
+
+    # Allow direct Tailscale access to Netdata port
+    networking.firewall.extraCommands = lib.mkAfter ''
+      iptables -I INPUT 1 -p tcp --dport ${toString cfg.port} -s 100.64.0.0/10 -j ACCEPT
+    '';
   };
 
 }