- Add shared/host-routing.sh with nft for NAT masquerade
- Add shared/install-host-services.sh to set up systemd watcher
- Add shared/uninstall-host-services.sh for cleanup
- Add /runtime volume mount for trigger file
- Update entrypoint.sh to trigger host routing when VPN connects
Run install-host-services.sh on host after app install.
Requires image rebuild for entrypoint changes.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
