The router service only opens SSH to the mgmt VLAN, the staging port and the ZeroTier mesh. Also admit it on the yggdrasil interface (`ygg`, as named by clan-core's service) so the box stays reachable when ZeroTier is down. Interface-scoped, so a spoofed 200::/7 source on the WAN never matches.