Add host routing watcher for cistech-tunnel (same pattern as rego-tunnel)

- Add shared/host-routing.sh with nft for NAT masquerade
- Add shared/install-host-services.sh to set up systemd watcher
- Add shared/uninstall-host-services.sh for cleanup
- Add /runtime volume mount for trigger file
- Update entrypoint.sh to trigger host routing when VPN connects

Run install-host-services.sh on host after app install.
Requires image rebuild for entrypoint changes.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/cistech-tunnel/shared/uninstall-host-services.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+#
+# Uninstall host-side systemd services for cistech-tunnel
+#
+set -euo pipefail
+
+echo "Removing cistech-tunnel host services..."
+
+# Stop and disable the watcher
+sudo systemctl stop cistech-routing-watcher.path 2>/dev/null || true
+sudo systemctl disable cistech-routing-watcher.path 2>/dev/null || true
+
+# Remove routing rules
+/etc/runtipi/repos/runtipi/apps/cistech-tunnel/shared/host-routing.sh stop 2>/dev/null || true
+
+# Remove systemd units
+sudo rm -f /etc/systemd/system/cistech-routing-watcher.path
+sudo rm -f /etc/systemd/system/cistech-routing-watcher.service
+
+# Reload systemd
+sudo systemctl daemon-reload
+
+echo ""
+echo "Done! Host services removed."