- Use Router Advertisements + SLAAC instead of pre-computed IPv6 addresses
- Add RDNSS to advertise DNS64 resolver to containers
- Add PREF64 option to advertise NAT64 prefix (RFC 8781)
- Fix MASQUERADE rule breaking localhost DNS (exclude 127.0.0.0/8)
- Add local-zone for NAT64 reverse DNS to prevent PTR lookup timeouts
- Remove nix-hashlib dependency (no longer needed with SLAAC)

- Add dns64-synthall to synthesize NAT64 addresses even for sites with AAAA
- Add jool-pool4-update service to configure pool4 with host's current IPv4
- Enable IPv4 forwarding for NAT64 translated packets
- Add IPv4 FORWARD and MASQUERADE rules for NAT64 traffic
- Fix krebs.iptables rules to use explicit v4/v6 flags
- Update virtulus container to use fd00:c700:: prefix and local DNS64

- Add extra-container and nix-hashlib flake inputs
- Create container-bridge.nix with ctr0 bridge and Jool NAT64
- Enable container bridge on xerxes
- Update virtulus container to use hostBridge with IPv6

Containers get deterministic IPv6 addresses derived from hostname
and access IPv4 internet via NAT64 translation.