relay: bind the host LAN IP, admit the podman bridge subnet only

169.254.1.2 is not a local address on this host (netavark runs its
bridges in aardvark-dns' netns), so the relay cannot bind it — and a
loopback bind refuses container traffic. Probe-socket proof: a host
socket on 192.168.0.143:18094 answers the container's 169.254.1.2:18094
dial while the LAN IP refuses from the container. The relay binds
192.168.0.143:18093 and the deployer installs an iptables INPUT pair
(ACCEPT 10.89.0.0/16, DROP rest) so the unauthenticated endpoint stays
off the LAN.

tests/observability_quadlet.bats

@@ -461,18 +461,22 @@ assert any('ALERTS' in e for e in exprs), exprs
     grep -q 'install_signal_relay' <(sed -n '/^deploy_observability()/,/^}/p' "$handler")
 }
 
-@test "the relay sends through the existing signal-cli account, podman-bridge only" {
+@test "the relay sends through the existing signal-cli account, bridge-subnet only" {
     # The credential is the account state under ~/.local/share/signal-cli;
-    # the number and account name are numbers, not secrets. The listener must
-    # bind 169.254.1.2 (host.containers.internal): a loopback bind refuses
-    # container traffic (measured 2026-09-17), and a host-interface bind
-    # would put an unauthenticated message-sending endpoint on the LAN —
-    # the failure this whole unit family exists to avoid.
+    # the number and account name are numbers, not secrets. The listener
+    # binds the host's LAN IP — the one address a bridge container can
+    # reach as host.containers.internal (measured 2026-09-17: loopback
+    # refuses, 169.254.1.2 is not local) — and the deployer admits the
+    # podman bridge subnet only, so the unauthenticated endpoint stays off
+    # the rest of the LAN.
     local relay="$REPO_ROOT/scripts/signal-relay.py"
+    local handler="$REPO_ROOT/scripts/deploy-remote.sh"
     grep -q 'signal-cli' "$relay"
     grep -q 'SIGNAL_CLI = "/usr/local/bin/signal-cli"' "$relay"
     grep -q 'SIGNAL_ACCOUNT = "318311"' "$relay"
-    grep -q 'LISTEN_ADDR = ("169.254.1.2", 18093)' "$relay"
+    grep -q 'LISTEN_ADDR = ("192.168.0.143", 18093)' "$relay"
+    grep -q -- '--dport 18093 -s 10.89.0.0/16 -j ACCEPT' "$handler"
+    grep -q -- '--dport 18093 -j DROP' "$handler"
 }
 
 @test "the planner selects alertmanager for its config and relay files" {