fix: get cloudflared WireGuard tunnel actually serving

- Dockerfile.cloudflared: add iptables + ip6tables (wg-quick needs them for ::/0 full tunnel)

- docker-compose: privileged:true for cloudflared so wg-quick can set net.ipv4.conf.all.src_valid_mark

- start-cloudflared.sh: restore resolv.conf after wg-quick (resolvconf wiped docker DNS 127.0.0.11 => app unresolvable => Host Error)

start-cloudflared.sh

@@ -6,7 +6,11 @@ set -e
 # cloudflared стартует сразу, как в базовой схеме Quick Tunnel.
 if [ -f /etc/wireguard/wg0.conf ]; then
   echo "WireGuard config found, bringing up wg0..."
+  cp /etc/resolv.conf /tmp/resolv.conf.default
   wg-quick up wg0
+  # wg-quick/resolvconf перезаписывает resolv.conf (убирает docker-DNS 127.0.0.11),
+  # из-за чего внутреннее имя app не резолвится. Восстанавливаем прежний конфиг.
+  cat /tmp/resolv.conf.default > /etc/resolv.conf
   echo "Waiting for WireGuard handshake..."
   # Формат `wg show wg0 latest-handshakes`: "<pubkey> <epoch-ts>"; 0 = handshake ещё не было.
   until wg show wg0 latest-handshakes | awk '{ if ($2 != 0) found=1 } END { exit !found }'; do