Upgrade K3s and infrastructure with selective DNS relay

ansible/roles/common/templates/control-plane-relay.nft.j2

@@ -0,0 +1,18 @@
+# Only this table is replaced; Kubernetes and Tailscale tables are left intact.
+add table inet k3s_control_plane_relay
+delete table inet k3s_control_plane_relay
+table inet k3s_control_plane_relay {
+    set peers4 {
+        type ipv4_addr
+        flags interval
+    }
+    set peers6 {
+        type ipv6_addr
+        flags interval
+    }
+    chain input {
+        type filter hook input priority -10; policy accept;
+        udp dport 41641 ip saddr @peers4 counter drop
+        udp dport 41641 ip6 saddr @peers6 counter drop
+    }
+}