After `lpppsssy`, `networking.nat` now recreates table ip nat on each switch, evicting
netavark's published-port DNAT rules and breaking Caddy reverse proxies
to published container ports. Pin the nftables driver so rules live in
an isolated table inet netavark that NixOS never touches.
