rego-tunnel: fix pipefail crash in host-routing.sh remove_all()

The nft|grep|grep|head pipeline fails when no masquerade rule exists,
causing the script to exit under set -euo pipefail. Add || true to
match the cistech-tunnel version.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/rego-tunnel/shared/host-routing.sh

@@ -94,7 +94,7 @@ remove_all() {
 
     # Remove masquerade rule (using nft)
     local handle
-    handle=$(nft -a list chain ip nat POSTROUTING 2>/dev/null | grep "saddr $LAN_SUBNET.*oifname.*$BRIDGE_NAME.*masquerade" | grep -oP 'handle \K\d+' | head -1)
+    handle=$(nft -a list chain ip nat POSTROUTING 2>/dev/null | grep "saddr $LAN_SUBNET.*oifname.*$BRIDGE_NAME.*masquerade" | grep -oP 'handle \K\d+' | head -1 || true)
     if [ -n "$handle" ]; then
         nft delete rule ip nat POSTROUTING handle "$handle" 2>/dev/null || true
     fi