fix(vpn): Replace UCI grev6 with manual GRE6 tunnel init script

OpenWrt 25.x lacks the netifd grev6 protocol handler, so the UCI
vpn_tunnel interface never came up (NO_DEVICE). Now using a dedicated
init script (parahub-vpn-tunnel, START=96) that:

- Creates ip6gre tunnel with encaplimit none (critical: Yggdrasil
  drops IPv6 packets with DSTOPT extension headers from encaplimit)
- Waits for Yggdrasil address before creating tunnel
- Adds guest subnet direct route to table 100 (fixes DNS/reply
  routing — without it, router replies with source in guest subnet
  get routed through GRE instead of back to the client)
- Reloads firewall so vpn_tunnel zone picks up gre6-vpn device

Also updated VPS mesh-gateway.sh with encaplimit none.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/init.d/parahub-vpn-tunnel

@@ -0,0 +1,71 @@
+#!/bin/sh /etc/rc.common
+# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
+# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
+# handler, so we create the tunnel manually with ip6gre.
+#
+# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
+# Destination Options extension headers (added by default encaplimit 4).
+
+START=96
+STOP=10
+
+VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
+GRE_LOCAL_IP="172.16.0.2"
+GRE_GATEWAY="172.16.0.1"
+
+start() {
+    # Only for Bumblebee role
+    [ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0
+
+    # Wait for Yggdrasil address (up to 60s)
+    local ygg_addr="" attempts=0
+    while [ $attempts -lt 30 ]; do
+        ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
+        [ -n "$ygg_addr" ] && break
+        attempts=$((attempts + 1))
+        sleep 2
+    done
+
+    if [ -z "$ygg_addr" ]; then
+        logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
+        return 1
+    fi
+
+    # Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
+    ip -6 tunnel add gre6-vpn mode ip6gre \
+        remote "$VPS_YGG" \
+        local "$ygg_addr" \
+        encaplimit none
+    ip addr add ${GRE_LOCAL_IP}/24 dev gre6-vpn
+    ip link set gre6-vpn mtu 1400 up
+
+    # Default route through GRE (table 100 — used by guest policy routing)
+    ip route add default via "$GRE_GATEWAY" table 100
+
+    # Guest subnet direct route in table 100
+    # Without this, router's own replies (source IP in guest subnet) go through
+    # GRE instead of back to the guest client (ip rule matches source-based)
+    local guest_subnet
+    guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
+    if [ -n "$guest_subnet" ]; then
+        local guest_dev
+        guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
+        if [ -n "$guest_dev" ]; then
+            ip route add "$guest_subnet" dev "$guest_dev" table 100
+            logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
+        else
+            logger -t parahub-vpn "Warning: guest device not found for $guest_subnet"
+        fi
+    fi
+
+    # Reload firewall so vpn_tunnel zone picks up gre6-vpn device
+    /etc/init.d/firewall reload 2>/dev/null &
+
+    logger -t parahub-vpn "GRE6 tunnel up: ${GRE_LOCAL_IP} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
+}
+
+stop() {
+    ip route flush table 100 2>/dev/null
+    ip -6 tunnel del gre6-vpn 2>/dev/null
+    logger -t parahub-vpn "GRE6 tunnel down"
+}