fix: allow container SSH through iptables DOCKER-USER chain

[hakhandelwal11]

Summary

Single-container builds on native Nebius fail at the container-ssh health check (wait for healthy health check container-ssh: context deadline exceeded). Container SSH (host 2222 → container 22) can't be reached from outside the instance.

Root cause

• brev-apply-docker-firewall.sh (applied via the 10-brev-firewall.conf docker.service drop-in) ends DOCKER-USER with -j DROP.
• Traffic to Docker-published ports is forwarded through DOCKER-USER, not UFW's INPUT rules, so ufw allow 2222/tcp doesn't help.
• Docker rewrites host:2222 to container:22 before the chain runs, so the traffic hits DROP.

Changes

• Added a DOCKER-USER rule before the DROP that allows container SSH on host port 2222.
• The rule matches on the port the client originally connected to (--ctorigdstport), so only host port 2222 is opened. Other published ports, including other containers' port 22, stay blocked.

[patelspratik]

does this expose the port directly to the internet or is it via our tunnels? I'm afraid we are exposing this out of bound so can't apply ingress/egress rules via Skybridge.

[hakhandelwal11]

does this expose the port directly to the internet or is it via our tunnels? I'm afraid we are exposing this out of bound so can't apply ingress/egress rules via Skybridge.

@patelspratik ,
Yes, it opens host port 2222 directly on the instance's public IP, not through Skybridge. The container-ssh health check that dev-plane runs during the build connects to the instance's public address on 2222. On Nebius, the DOCKER-USER DROP rule blocked that, so single-container builds timed out.

This follows the same approach as #100 for Shadeform, and Nebius already allows 2222 in UFW (ufw allow 2222/tcp).