fix(net): trust wg-br bridge for VPN namespace->host traffic

Allows VPN-confined services (Prowlarr) to reach host-network
services (Sonarr, Radarr) via the namespace bridge interface.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

configuration.nix

@@ -198,6 +198,7 @@
     hostName = hostname;
     hostId = "0f712d56";
     firewall.enable = true;
+    firewall.trustedInterfaces = [ "wg-br" ];
     useDHCP = false;
     enableIPv6 = false;