fix nftables syntax: use meta nfproto ipv6 in inet table ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: route client IPv6 through wg-to-wgnet ...

- Re-add IPv6 default route (::/0) via wg-to-wgnet in table 1002
- Add NAT66 masquerade on wg-to-wgnet for client ULA→tunnel translation
- Campus WAN has no IPv6 transit; wgnet provides it

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: fix IPv6 routing, clean up table names ...

- Remove IPv6 default route from freedom table (1002) — wgnet peer
  doesn't forward IPv6, causing TLS resets on outbound connections
- Remove Tsinghua IPv6 throw route (unnecessary without IPv6 default)
- IPv6 now uses native WAN path instead of WireGuard tunnel
- Rename table 1002 from typo 'wg-to-skywme' to 'freedom-wgnet'

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>