fix(firewall): accept IPv6 MLD/ND multicast (ff02::1, ff02::2, ff02::fb)

Neighbor multicast to ff02::1 (MLDv2 reports from other hosts) was
hitting the LOG+DROP tail — ~1800 FW6-DROP lines/6h in journald,
i.e. ~5/min of pure log spam from ICMPv6 layer-2 discovery. Accept
link-local multicast ranges before the logging rule.

flake.nix

@@ -61,7 +61,7 @@
         # ── Fetch submodule source ──
         submoduleSrc = name: builtins.fetchGit {
           url = submoduleRepos.${name};
-          rev = if name == "hub" then "f35edb00d72675e7f41bdf8f3b54a17e1a241d1a"
+          rev = if name == "hub" then "6829c7efe2a735d249f5135bff4a0fc28411a295"
                else if name == "scraper" then "62aa5b0e52859afe3ba9de1c7b11cfe2dacf6c2c"
                else if name == "tools" then "3956b90c3ce39ffa7ffba8084937f20e11364d6b"
                else if name == "llm-api" then "67861f384bd4f64d5236a9608b33c965fbebbc7f"

infra/firewall/firewall.sh

@@ -66,7 +66,13 @@ ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 4013 -j ACCEPT
+# ICMPv6/MLD: ping + neighbor discovery (NIC multicast ff02::1 = MLDv2 reports
+# dari host lain; kena LOG+DROP tiap menit — 1800 baris/6h di journal).
+# IPv6 layer-2 discovery WAJIB di-ACCEPT, bukan cuma dropped.
 ip6tables -A INPUT -p icmpv6 -j ACCEPT
+ip6tables -A INPUT -d ff02::1 -j ACCEPT
+ip6tables -A INPUT -d ff02::2 -j ACCEPT
+ip6tables -A INPUT -d ff02::fb -j ACCEPT
 ip6tables -A INPUT -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "FW6-DROP " --log-level 4
 ip6tables -A INPUT -j DROP