feat: add isolated Grace website editor VM

[ajaxbits]

Summary

• Add a manually started cloud-hypervisor MicroVM for Grace's OpenCode website editor, with persistent guest storage and an isolated bridge.
• Install opencode2 from the pinned llm-agents.nix input and run the editor and Astro preview inside the guest.
• Forward only LAN connections addressed to 172.22.0.10:4096/4321.

Network safety corrections

The original revision enabled the global NixOS nftables service, which defaults to flushing all rules on this host's stateVersion. That implementation has been replaced.

• A dedicated grace-editor-firewall service owns ONLY inet grace_editor; no global nftables/NAT service enablement, ruleset flush, or ip_tables blacklist.
• Atomic install/reload and table-local cleanup preserve other rule owners.
• Stateful replies, guest-source validation, host INPUT protection, private/CGNAT destination blocks, guest IPv6 denial, and LAN-only destination-scoped DNAT.
• Existing br0 addressing, gateway and DNS remain unchanged. Host bridge/tap DHCP and IPv6 RA are disabled to prevent guest route injection.
• Explicit autostart = false; the VM requires its installation and firewall services. BindsTo + After stop the VM before firewall removal.

Validation

• PASS: packet-level tests using generated deployment rules in fresh network/mount/PID namespaces. Covered both UI ports, Internet TCP and UDP DNS replies, SNAT, host/LAN/tailnet isolation, spoofing/IPv6, unrelated traffic, other owners' tables across reload/removal, a live connection across reload, and retention of the old policy on an invalid reload.
• PASS: full patroclus and patroclusStripped toplevel derivation evaluation.
• PASS: effective normal-host settings confirm global nftables/NAT disabled, blacklist empty and VM autostart false.
• nix flake check --no-build remains blocked by the existing agenix dev-shell package using removed substituteAll.
• No live host network changes or NixOS activation performed. The full host closure has not been built/boot-tested.

Two small prerequisite fixes in a separate commit allow normal patroclus evaluation: provide isStripped = false explicitly and normalize the duplicate rclone secret-file definition to the same string value.

See components/website-editor/README.md for test and start commands. Merge the companion website workflow PR before first boot. The guest still needs its own Copilot login and repository push credential.