server: podman: use nftables firewall driver

After `lpppsssy`, `networking.nat` now recreates table ip nat on each switch, evicting
netavark's published-port DNAT rules and breaking Caddy reverse proxies
to published container ports. Pin the nftables driver so rules live in
an isolated table inet netavark that NixOS never touches.

hosts/imxyy-nix-server/docker.nix

@@ -1,14 +0,0 @@
-{ lib, ... }:
-{
-  virtualisation.oci-containers.backend = lib.mkForce "podman";
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
-    defaultNetwork.settings.dns_enabled = true;
-  };
-  # avoid collision with dnsmasq
-  virtualisation.containers = {
-    containersConf.settings.network.dns_bind_port = 5353;
-  };
-}

hosts/imxyy-nix-server/podman.nix

@@ -0,0 +1,20 @@
+{ lib, ... }:
+{
+  virtualisation.oci-containers.backend = lib.mkForce "podman";
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+  virtualisation.containers = {
+    containersConf.settings.network = {
+      # avoid collision with dnsmasq
+      dns_bind_port = 5353;
+      # keep netavark rules in an isolated `table inet netavark` instead of the
+      # `table ip nat` that networking.nat recreates on each nixos-rebuild switch,
+      # which would otherwise evict podman's published-port DNAT rules.
+      firewall_driver = "nftables";
+    };
+  };
+}