feat(infra): hardening firewall + sysctl + ssh

- deny-by-default iptables/ip6tables: public cuma 22/80/443/4013,
  sisanya localhost + tailscale CGNAT; log FW-DROP rate-limited
- persist via netfilter-persistent (rules.v4/v6) + /usr/local/bin/firewall.sh
- sysctl hardening: syncookies, rp_filter, redirect off, kptr/dmesg
  restrict, protected links, somaxconn, tcp retries tuner
- sshd: PasswordAuthentication no (fix 50-cloud-init.conf override),
  PermitRootLogin prohibit-password, MaxAuthTries 4, LoginGraceTime 30,
  X11Forwarding no

infra/firewall/99-ssh-optimization.conf

@@ -0,0 +1,12 @@
+ClientAliveInterval 60
+ClientAliveCountMax 3
+MaxStartups 100:30:200
+MaxSessions 100
+TCPKeepAlive yes
+
+# Hardening 2026-08-02
+MaxAuthTries 4
+LoginGraceTime 30
+PermitRootLogin prohibit-password
+X11Forwarding no
+AllowTcpForwarding yes