relay: admit loopback and the host itself before the DROP

The bridge-subnet-only pair dropped the host's own health probe
(source 192.168.0.143/127.0.0.1) and failed a healthy deploy. The
deployer now installs the full set: ACCEPT 127.0.0.1, ACCEPT the host
IP, ACCEPT 10.89.0.0/16, then DROP.

AGENTS.md

@@ -130,7 +130,7 @@ delivered: Prometheus → Alertmanager (`dankclaw/observability/quadlet/
 alertmanager.container`, loopback :9093) → host-side Signal relay
 (`scripts/signal-relay.py`, user unit, 192.168.0.143:18093 — the host LAN
 IP, the one bind a container can reach as `host.containers.internal`;
-iptables admits the podman bridge subnet only) → signal-cli account 318311.
+iptables admits loopback, the host and the podman bridge subnet only) → signal-cli account 318311.
 Prometheus targets read down for structural reasons (HTML-scraped "probes",
 Gitea metrics off); the remedy is a blackbox exporter. See
 `serverAppConfigs-docs/Infrastructure/Observability.md`.