fix(live-usb): nft rule syntax — udp dport 68 (drop the redundant udp sport)

v2.12.11's rule `udp sport 67 udp dport 68 accept` was invalid nft
syntax — protocol prefix can't be repeated inside a single rule, the
firstboot.sh-generated /etc/nftables.conf failed to load and the
firewall stayed in its previous state (or empty), defeating the
whole point of the DHCP fix.

Just match the destination port: `udp dport 68 accept`. DHCPOFFER /
DHCPACK from any server (sport 67) lands on dport 68 of the client,
so the inbound match is sufficient and unambiguous.

Live-system workaround (no rebuild needed):
  nft add rule inet secubox_filter input udp dport 68 accept

image/build-live-usb.sh

@@ -3521,6 +3521,7 @@ else
   fi
 fi
 
+
 # Mount for file copy
 MNT="${WORK_DIR}/mnt"
 mkdir -p "${MNT}/esp" "${MNT}/live"
@@ -3688,12 +3689,11 @@ fi
 
 cp "${MNT}/esp/boot/grub/grub.cfg" "${MNT}/esp/EFI/BOOT/grub.cfg"
 
-# Build GRUB EFI — restored to the simple pre-e1a53297 working version.
-# The "hardened" variant added disk/usb/usbms/ahci/ata modules (none
-# exist in x86_64-efi — disks come from the EFI firmware) and a
-# multi-stage search fallback that landed in a grub> shell on real
-# UEFI hardware. This version was reported working on bare-metal
-# amd64 in v2.10.x and earlier; keep it as-is and don't gold-plate.
+# Build GRUB EFI — verbatim from v2.10.3 (last known-good real UEFI
+# boot). Do NOT optimise this block: every "improvement" attempted in
+# the v2.12.x series (Secure Boot shim, $cmdpath, search --fs-uuid,
+# extra modules, multi-stage fallbacks) broke at least one piece of
+# hardware. Stay simple, stay shipped.
 GRUB_MODS="part_gpt part_msdos fat ext2 normal linux boot configfile loopback chain efi_gop efi_uga ls search search_label gfxterm all_video"
 
 cat > "${WORK_DIR}/grub-embed.cfg" <<'EMBEDCFG'

image/firstboot.sh

@@ -443,6 +443,16 @@ table inet secubox_filter {
         # HTTP/HTTPS (SecuBox UI)
         tcp dport { 80, 443 } accept
 
+        # DHCP client — accept DHCPOFFER / DHCPACK on UDP 68. The
+        # conntrack `established,related` clause above doesn't help
+        # for DHCP because the request goes out from 0.0.0.0:68 and
+        # the reply comes back broadcast (or unicast direct to the
+        # offered IP before it's actually bound), neither of which
+        # match the original 5-tuple. Without this rule networkd's
+        # DHCP times out and secubox-net-fallback's ARP-probe takes
+        # over — operator ends up on a random fallback subnet.
+        udp dport 68 accept
+
         # WireGuard
         udp dport 51820 accept