fix(#2363): open UDP 67 on the bridge — host firewall dropped DHCP requests

nix/modules/hive-network.nix

@@ -163,9 +163,16 @@ in
         }
       ];
 
-      # DNS only on the bridge interface — no external amplification surface.
+      # DNS + DHCP on the bridge interface only — no external amplification
+      # surface. UDP 67 is required for the dnsmasq DHCP pool: dnsmasq
+      # receives DHCPDISCOVER via a regular UDP socket (no netfilter-bypassing
+      # raw socket like ISC dhcpd), so without this hole the host INPUT chain
+      # drops the broadcasts and every container falls back to IPv4LL.
       networking.firewall.interfaces.${cfg.bridgeName} = {
-        allowedUDPPorts = [ 53 ];
+        allowedUDPPorts = [
+          53
+          67
+        ];
         allowedTCPPorts = [ 53 ];
       };
     })