Add MealQuest host firewall unit for port 8090

Restrict the published MealQuest port 8090 in DOCKER-USER to Traefik
(10.60.1.33) and the Docker host (10.60.1.14), dropping all other
sources. DOCKER-USER sees post-DNAT traffic, so rules match the original
destination port with conntrack rather than --dport. A docker.service
drop-in re-applies the rules after every docker restart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/mealquest-firewall.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Restrict MealQuest port 8090 to Traefik (DOCKER-USER)
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/mealquest-firewall
+
+[Install]
+WantedBy=multi-user.target