relay: bind the host LAN IP, admit the podman bridge subnet only

169.254.1.2 is not a local address on this host (netavark runs its
bridges in aardvark-dns' netns), so the relay cannot bind it — and a
loopback bind refuses container traffic. Probe-socket proof: a host
socket on 192.168.0.143:18094 answers the container's 169.254.1.2:18094
dial while the LAN IP refuses from the container. The relay binds
192.168.0.143:18093 and the deployer installs an iptables INPUT pair
(ACCEPT 10.89.0.0/16, DROP rest) so the unauthenticated endpoint stays
off the LAN.

AGENTS.md

@@ -128,8 +128,9 @@ provisioned from `shared/grafana/provisioning/`, `shared/prometheus/rules/
 llm-fleet.yml` loads 5 alert rules + 1 recording rule, and firing rules are
 delivered: Prometheus → Alertmanager (`dankclaw/observability/quadlet/
 alertmanager.container`, loopback :9093) → host-side Signal relay
-(`scripts/signal-relay.py`, user unit, 169.254.1.2:18093 — the
-host.containers.internal endpoint) → signal-cli account 318311. Five
+(`scripts/signal-relay.py`, user unit, 192.168.0.143:18093 — the host LAN
+IP, the one bind a container can reach as `host.containers.internal`;
+iptables admits the podman bridge subnet only) → signal-cli account 318311.
 Prometheus targets read down for structural reasons (HTML-scraped "probes",
 Gitea metrics off); the remedy is a blackbox exporter. See
 `serverAppConfigs-docs/Infrastructure/Observability.md`.