Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

spec/server-baseline.yaml

@@ -6,7 +6,7 @@
 # When you change something here, update the Ansible roles AND the Goss tests.
 # Format: human-readable YAML, kept technology-neutral.
 
-version: "1.0"
+version: "1.1"
 applies_to: all  # override per node group if needed
 
 # ---------------------------------------------------------------------------
@@ -17,6 +17,8 @@ firewall:
   status: active
   default_incoming: deny
   default_outgoing: allow
+  # Hosts with ufw_manage: false (CoulombCore) keep their existing packet
+  # filter. Do not enable UFW there as a side effect of an unrelated converge.
   rules:
     - name: OpenSSH   # UFW app name; resolves to 22/tcp
       action: allow
@@ -24,10 +26,17 @@ firewall:
       port: 6443
       proto: tcp
       action: allow
+      sources: []   # tunnel-only (ADR-005); public allowlist stays empty
     - name: flannel-vxlan
       port: 8472
       proto: udp
       action: allow
+      sources: []   # omit while single-node; peer addresses only when multi-node
+    - name: nydus-ex-api
+      port: 2224
+      proto: tcp
+      action: allow
+      sources: anywhere   # HostEurope provider agent; required by the VPS platform
 
 # ---------------------------------------------------------------------------
 # SSH daemon