Add host routing watcher for cistech-tunnel (same pattern as rego-tunnel)

- Add shared/host-routing.sh with nft for NAT masquerade
- Add shared/install-host-services.sh to set up systemd watcher
- Add shared/uninstall-host-services.sh for cleanup
- Add /runtime volume mount for trigger file
- Update entrypoint.sh to trigger host routing when VPN connects

Run install-host-services.sh on host after app install.
Requires image rebuild for entrypoint changes.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/cistech-tunnel/docker-compose.json

@@ -16,7 +16,8 @@
         "NOVNC_PORT": "6902"
       },
       "volumes": [
-        { "hostPath": "${APP_DATA_DIR}/data", "containerPath": "/root" }
+        { "hostPath": "${APP_DATA_DIR}/data", "containerPath": "/root" },
+        { "hostPath": "${APP_DATA_DIR}", "containerPath": "/runtime" }
       ]
     }
   ]