Onboard mx1 mail host and factor out per-host public IPs

- Register mx1 in the inventory and as a direct-SSH `internet` host; give it
  a static public IPv6 (2a01:4ff:2f0:1963::1).
- Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record.
- Bring mx1 into monitoring: import exporters, add it to the mesh map and the
  node scrape job so its host metrics and journald reach control.
- Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public
  SSH (admin rides the mesh like the other hosts). 587/465/993 held for now.
- Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by
  clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address
  is declared once instead of being duplicated across configs.
- docs: add mx1 to the machines table.

modules/hetzner-firewall-rules.nix

@@ -24,6 +24,17 @@ let
     description = "ICMP (ping / PMTUD)";
   };
 
+  # Inbound mail only. mx1 is the MX for cnx.email, so other servers deliver on
+  # 25. Submission (587/465) and IMAP (993) stay closed until the mail stack and
+  # mailboxes exist — admin access rides the mesh, same as the other hosts.
+  smtp = {
+    direction = "in";
+    protocol = "tcp";
+    port = "25";
+    source_ips = world;
+    description = "SMTP (inbound mail)";
+  };
+
   dnsRules = [
     {
       direction = "in";
@@ -50,4 +61,9 @@ in
   ];
   "clan-ns1" = dnsRules;
   "clan-ns2" = dnsRules;
+  "clan-mx1" = [
+    smtp
+    zerotier
+    ping
+  ];
 }