docs: add Tailscale kernel-mode iptables-legacy collision note

Discovered while deploying NetBird on CT124 (which already runs
Tailscale in kernel mode). Tailscale's ts-input/ts-forward chains
drop all 100.64.0.0/10 traffic not coming from tailscale0, and since
NetBird uses 100.71.0.0/16 (within that CGNAT range), its wt0
traffic gets silently dropped.

Captured:
- Symptom recognition (Connected in status but 100% ping loss)
- Distinguishing when it hits (kernel-mode Tailscale vs userspace)
- Fix: iptables-legacy -I INPUT/FORWARD allow rules on wt0
- Persistence: systemd oneshot + /usr/local/sbin script
  (iptables-persistent doesn't cover the legacy table)

SUMMARY.md

@@ -87,6 +87,7 @@ reopen fd 8: permission denied
 | ping RTT 尖峰到 2-4 秒 | 當下 WiFi/ISP 有 bufferbloat | 用 `networkQuality -v` 確認（看 RPM），與 NetBird 無關 |
 | Mac `netbird status` 卡在 `Management: Disconnected, rpc error` | daemon 本身卡死，`netbird up`/`down` 救不回 | `sudo launchctl kickstart -k system/netbird`（服務名是 `netbird` 而非 `io.netbird.client`）；見 [peer-deployment-ops.md](./peer-deployment-ops.md) |
 | LXC CT100 SSH root 密碼被擋（`Permission denied`） | sshd_config 內有 `PermitRootLogin prohibit-password` 比 `yes` 先出現，first-match-wins | 加 `/etc/ssh/sshd_config.d/99-allow-root.conf` 覆蓋；socket activation 不需重啟 sshd |
+| 新 peer `netbird status` 顯示 Connected 但互 ping 都不通 | 主機同時跑 Tailscale kernel-mode，`iptables-legacy ts-input` 把 `100.64.0.0/10` 非 tailscale0 封包全 drop，NetBird `100.71.0.0/16` 中彈 | `iptables-legacy -I INPUT 1 -i wt0 -j ACCEPT` + FORWARD 同理；systemd 持久化；詳見 [peer-deployment-ops.md](./peer-deployment-ops.md) |
 
 ## 檔案位置