After `lpppsssy`, `networking.nat` now recreates table ip nat on each switch, evicting netavark's published-port DNAT rules and breaking Caddy reverse proxies to published container ports. Pin the nftables driver so rules live in an isolated table inet netavark that NixOS never touches.