stellio: allow ssh over yggdrasil

The router service only opens SSH to the mgmt VLAN, the staging port
and the ZeroTier mesh. Also admit it on the yggdrasil interface (`ygg`,
as named by clan-core's service) so the box stays reachable when
ZeroTier is down. Interface-scoped, so a spoofed 200::/7 source on the
WAN never matches.

machines/stellio/configuration.nix

@@ -83,6 +83,17 @@
       '')
     ];
 
+    # The router service opens SSH only to the mgmt VLAN, the staging port
+    # and the ZeroTier mesh (inventories/router.nix). Also admit it over
+    # Yggdrasil (fleet-wide instance in inventories/default.nix) so the box
+    # stays reachable when ZeroTier's controller/relays are down. Scoped to
+    # the tunnel interface (clan-core's yggdrasil service names it `ygg`):
+    # only decrypted 200::/7 traffic arrives there, so a spoofed source on
+    # the WAN never matches.
+    networking.firewall.interfaces.${config.services.yggdrasil.settings.IfName}.allowedTCPPorts = [
+      22
+    ];
+
     systemd.services.heartbeat-push = {
       description = "Heartbeat push to uptime monitor";
       serviceConfig = {