feat: server-core → network_mode host for direct WireGuard routing

- docker-compose.yml: server-core uses host network (no bridge isolation)
- docker-compose.yml: postgres/redis expose ports on 127.0.0.1 only
- docker-compose.dev.yml: also uses host network
- WireGuard now runs on host network stack (wg show works on host)
- nftables rules apply directly to host (proper peer isolation)

docker-compose.dev.yml

@@ -1,4 +1,3 @@
-
 services:
   server-core:
     build:
@@ -8,5 +7,6 @@ services:
     command: ["sh", "-c", "go install github.com/air-verse/air@latest && air"]
     volumes:
       - ./apps/server-core:/app
+    network_mode: host
     environment:
-      - GIN_MODE=debug
+      - GIN_MODE=debug

docker-compose.yml

@@ -1,4 +1,3 @@
-
 services:
   postgres:
     image: postgres:16-alpine
@@ -8,6 +7,8 @@ services:
       POSTGRES_DB: nexusguard
     volumes:
       - pgdata:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:5432:5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U nexusguard"]
       interval: 5s
@@ -21,6 +22,8 @@ services:
     image: redis:7-alpine
     volumes:
       - redisdata:/data
+    ports:
+      - "127.0.0.1:6379:6379"
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
@@ -34,20 +37,19 @@ services:
     build:
       context: ./apps/server-core
       dockerfile: Dockerfile
+    network_mode: host
     environment:
-      - DB_HOST=postgres
+      - DB_HOST=127.0.0.1
       - DB_PORT=5432
       - DB_USER=nexusguard
       - DB_PASSWORD=${DB_PASSWORD:-nexusguard}
       - DB_NAME=nexusguard
-      - REDIS_ADDR=redis:6379
+      - REDIS_ADDR=127.0.0.1:6379
       - JWT_SECRET=${JWT_SECRET:-changeme}
       - SERVER_SALT=${SERVER_SALT:-changeme}
       - NFTABLES_TABLE=nexusguard
       - IPAM_POOL=10.8.0.0/16
       - GIN_MODE=release
-    ports:
-      - "${API_PORT:-8080}:8080"
     depends_on:
       postgres:
         condition: service_healthy
@@ -57,15 +59,12 @@ services:
       - NET_ADMIN
       - NET_RAW
     restart: unless-stopped
-    networks:
-      - nexusnet
 
   dashboard-ui:
     build:
       context: ./apps/dashboard-ui
       dockerfile: Dockerfile
       args:
-        # Inject the root .env variable into the frontend build process
         VITE_API_BASE_URL: ${VITE_API_BASE_URL}
     ports:
       - "${WEB_PORT:-80}:80"
@@ -81,4 +80,4 @@ volumes:
 
 networks:
   nexusnet:
-    driver: bridge
+    driver: bridge