router: allow SSH on the staging port

The staging uplink is in no VLAN zone and was fully default-deny; admit
TCP 22 on it so the box is reachable from the old LAN before the mgmt
VLAN or the mesh are up. Everything else on the port stays closed.

modules/clan/router/firewall.nix

@@ -3,6 +3,7 @@
 #   other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN
 #   WAN (ppp0) -> nothing inbound beyond established/related
 #   mesh       -> admin SSH + metrics scrapes (same trust boundary as the fleet)
+#   staging    -> admin SSH only (pre-cutover uplink into the old LAN)
 { settings }:
 { lib, ... }:
 let
@@ -26,14 +27,20 @@ in
     filterForward = true;
     trustedInterfaces = [ "vlan-mgmt" ];
 
-    # Non-mgmt VLANs may only talk to the router's DNS and DHCP.
-    interfaces = lib.genAttrs nonMgmtIfs (_: {
+    # Non-mgmt VLANs may only talk to the router's DNS and DHCP; the staging
+    # uplink (old LAN, pre-cutover) gets admin SSH so the box can be reached
+    # before the mgmt VLAN or the mesh are up.
+    interfaces =
+      lib.genAttrs nonMgmtIfs (_: {
         allowedTCPPorts = [ 53 ];
         allowedUDPPorts = [
           53
           67
         ];
-    });
+      })
+      // lib.optionalAttrs (cfg.stagingPort != null) {
+        ${cfg.stagingPort}.allowedTCPPorts = [ 22 ];
+      };
 
     extraInputRules = ''
       ip6 saddr ${cfg.mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh"