feat: Athena Firewall

Reviewed-on: #7

machines/mibook/configuration.nix

@@ -10,6 +10,7 @@
     ./disks.nix
     ./hardware-configuration.nix
     ./environments.nix
+    ./network.nix
     # ./system.nix use docker here
   ];
 

machines/mibook/network.nix

@@ -0,0 +1,8 @@
+_: {
+  # Athena (local AI): allow LAN access to the Hermes web dashboard.
+  # Bound to 0.0.0.0:9119 in the athena docker stack; NixOS default-deny
+  # firewall otherwise blocks inbound connections from other devices.
+  networking.firewall.allowedTCPPorts = [
+    9119 # athena hermes dashboard
+  ];
+}