docs: add NetBird Network Routes (Subnet Router) guide

CT100 now routes 192.168.42.0/24 for the personal group, letting
Mac/iPhone reach LAN devices that don't run NetBird (OpenWrt,
Proxmox nodes, NAS, printers, cameras, etc).

- IP forwarding persisted via /etc/sysctl.d/99-netbird-route.conf
- Route created with masquerade=true, metric=9999
- access_control_groups restricts who can use the route
- Chose CT100 over CT124 to avoid the Tailscale kernel-mode
  iptables collision documented in peer-deployment-ops.md

Doc covers: concept, API + UI creation, verification, troubleshooting
(forwarding, masquerade, LXC caveats, Tailscale interference),
and security considerations for narrowing the route CIDR.

SUMMARY.md

@@ -103,7 +103,8 @@ reopen fd 8: permission denied
 ├── stun-port-conflict.md             ← STUN 改用 3479 (3478 被 Headscale 佔用)
 ├── client-troubleshooting.md         ← 客戶端 Force Relay / bufferbloat 排錯
 ├── peer-deployment-ops.md            ← Docker 部署客戶端、改名、Mac daemon 重啟
-└── groups-and-policies.md            ← Groups 與 Access Control 設計與操作
+├── groups-and-policies.md            ← Groups 與 Access Control 設計與操作
+└── network-routes.md                 ← Subnet Router 讓 peer 存取 LAN 非 NetBird 裝置
 ```
 
 ### 遠端伺服器（192.168.42.127:/opt/netbird/）