feat(#1971): network.exposeHostPorts to reach host-loopback services from agents

docs/network.md

@@ -100,6 +100,27 @@ When `isolateContainers = true`, `allowedTCPPorts` is extended with
 shared host netns) for the forge sub-domain, per-agent UI proxies,
 and any other HTTP services.
 
+### Reaching host-loopback services (`exposeHostPorts`)
+
+Agents are deliberately cut off from the host loopback (the bridge→
+`127.0.0.0/8` DROP rule below), so a service that only binds
+`127.0.0.1` on the host — e.g. a dev OTEL collector for
+`services.hyperhive.otel.endpoint` — is unreachable by default.
+
+`services.hyperhive.network.exposeHostPorts = [ 4318 ];` opens a
+controlled path for each listed TCP port `P`:
+
+- a socket-activated `systemd-socket-proxyd` (`hive-hostport-<P>`)
+  listens on `<bridgeIp>:P` and forwards to `127.0.0.1:P`;
+- `P` is added to the bridge-interface `allowedTCPPorts`.
+
+The agent then points at `http://<bridgeIp>:P` (default
+`http://10.42.0.1:4318`). This keeps the loopback DROP rule intact:
+agents only ever connect to the bridge IP, and the host's own proxy
+process is what dials `127.0.0.1`. The port is reachable by **every**
+agent on the bridge subnet (like DNS/gateway), so only expose services
+safe for any agent to reach.
+
 ## Container isolation
 
 `services.hyperhive.network.isolateContainers` (default `false`) flips