Add MealQuest host firewall unit for port 8090

Restrict the published MealQuest port 8090 in DOCKER-USER to Traefik
(10.60.1.33) and the Docker host (10.60.1.14), dropping all other
sources. DOCKER-USER sees post-DNAT traffic, so rules match the original
destination port with conntrack rather than --dport. A docker.service
drop-in re-applies the rules after every docker restart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/docker.service.d/mealquest-firewall.conf

@@ -0,0 +1,3 @@
+# Re-apply the MealQuest DOCKER-USER rules after every docker (re)start.
+[Service]
+ExecStartPost=/usr/local/sbin/mealquest-firewall

deploy/systemd/mealquest-firewall.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Restrict MealQuest port 8090 to Traefik (DOCKER-USER)
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/mealquest-firewall
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/mealquest-firewall.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Restrict the MealQuest published host port to Traefik (10.60.1.33) and the
+# Docker host itself (10.60.1.14); drop every other source.
+#
+# DOCKER-USER runs after Docker's DNAT, so the destination port there is the
+# container port (8080), not the published one. Match the original
+# destination port with conntrack instead of --dport.
+#
+# Idempotent: each rule is checked (-C) before it is added, so re-runs add
+# nothing. Installed as /usr/local/sbin/mealquest-firewall.
+set -eu
+
+port=8090
+match="-p tcp -m conntrack --ctorigdstport $port --ctdir ORIGINAL"
+
+iptables -C DOCKER-USER -s 10.60.1.33/32 $match -j RETURN 2>/dev/null ||
+	iptables -I DOCKER-USER 1 -s 10.60.1.33/32 $match -j RETURN
+iptables -C DOCKER-USER -s 10.60.1.14/32 $match -j RETURN 2>/dev/null ||
+	iptables -I DOCKER-USER 2 -s 10.60.1.14/32 $match -j RETURN
+iptables -C DOCKER-USER $match -j DROP 2>/dev/null ||
+	iptables -A DOCKER-USER $match -j DROP