ha: replace the HAOS VM with a native Podman Quadlet container

The fixed 2 GiB ha_van allocation starved the 4 GB Pi. HA Container now
runs on the host network (http://10.42.0.1:8123): ha/homeassistant.container
installs to /etc/containers/systemd/, config in /srv/homeassistant, host
D-Bus mounted for onboard Bluetooth (needs apparmor=unconfined — Ubuntu's
dbus-daemon mediates per AppArmor label and denies AddMatch to BlueZ —
plus NET_ADMIN/NET_RAW for habluetooth adapter recovery).

Drop the VM-era plumbing: the 10.42.0.50 dhcp-host pin becomes a
host-record for 10.42.0.1, and the legacy-URL DNAT + hairpin masquerade
go away entirely. ha_van.xml retired to git history.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ap/nftables.conf

@@ -4,20 +4,8 @@
 table ip van_router_nat
 delete table ip van_router_nat
 table ip van_router_nat {
-    chain prerouting {
-        type nat hook prerouting priority dstnat; policy accept;
-        # Home Assistant VM (ha_van) is bridged onto br0 at 10.42.0.50 — clients reach
-        # it directly. Keep the legacy http://10.42.0.1:8123 URL working for anything
-        # that bookmarked it (phones, ZT clients).
-        ip daddr 10.42.0.1 tcp dport 8123 dnat to 10.42.0.50:8123
-    }
     chain postrouting {
         type nat hook postrouting priority srcnat; policy accept;
         ip saddr 10.42.0.0/24 oifname != "br0" masquerade
-        # Hairpin for the legacy 10.42.0.1:8123 DNAT when the client sits on the same
-        # subnet as the HA VM: without masquerade the VM would reply directly on br0
-        # from 10.42.0.50 and the client (expecting 10.42.0.1) would drop it. ZT-sourced
-        # traffic doesn't match and doesn't need it — VM replies route back through us.
-        ip saddr 10.42.0.0/24 ip daddr 10.42.0.50 tcp dport 8123 oifname "br0" masquerade
     }
 }