7454b5f110
Host now dual-homed LAN + WiFi (192.168.8.141 on wlp3s0, metric 200). wan-failover.service handles carrier-based default-route swap since the bridge's carrier follows LXC veths and ignore_routes_with_linkdown can't catch eno1 going down on its own. LXC/VM guests still LAN-only; Phase 2 migrates them.