Implement eBPF host firewall (allow nullnet traffic only)

[GyulyVGC]

• Add a default-deny TC classifier on the uplink NIC (ingress + egress). Allows only nullnet traffic: ARP, gRPC to the server, and VXLAN/forward (4789/9999) to/from known peers
• Remove the old nullnet-firewall crate and its plumbing
• Auto-detect the uplink NIC from the default route (drops ETH_NAME)