allow-device-http admitted world on 2345/TCP. The TRMNL panel lives on
IoT (terminus log: GET /api/display from 10.2.30.244 every ~5 min) and
terminus-device is ETP=Local, so the client address reaches the pod.
Source is now net-iot; host/remote-node stay for probes.
Depends on #1583 (CiliumCIDRGroup net-iot).
Refs S28-19
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>