fix: allow container SSH through iptables DOCKER-USER chain

[hakhandelwal11]

Summary

Single-container builds on native Nebius fail at the container-ssh health check (wait for healthy health check container-ssh: context deadline exceeded). Container SSH (host 2222 → container 22) can't be reached from outside the instance.

Root cause

• brev-apply-docker-firewall.sh (applied via the 10-brev-firewall.conf docker.service drop-in) ends DOCKER-USER with -j DROP.
• Traffic to Docker-published ports is forwarded through DOCKER-USER, not UFW's INPUT rules, so ufw allow 2222/tcp doesn't help.
• Docker rewrites host:2222 to container:22 before the chain runs, so the traffic hits DROP.

Changes

• Added a DOCKER-USER rule before the DROP that allows container SSH on host port 2222.
• The rule matches on the port the client originally connected to (--ctorigdstport), so only host port 2222 is opened. Other published ports, including other containers' port 22, stay blocked.