Docs: DSM firewall blocks container-to-container traffic

Diagnosed on a real Synology: with the DSM firewall enabled, iptables reads

    -A FORWARD -j FORWARD_FIREWALL      <- DSM, first, default deny
    -A FORWARD -j DEFAULT_FORWARD       <- Docker's ACCEPT rules, never reached

and bridge-nf-call-iptables=1 sends container-to-container packets through
FORWARD. A new connection to postgres:5432 matches no DSM allow rule and is
dropped before Docker's own "-i docker-xxx -o docker-xxx -j ACCEPT" is
consulted. RELATED,ESTABLISHED is accepted, which is why the port could test
open from a throwaway container while every new connection timed out — the
symptom looked intermittent and pointed nowhere near the firewall.

- docs §8: the diagnosis, the one-line fix
  (iptables -I FORWARD 1 -i docker+ -o docker+ -j ACCEPT), a boot-up Triggered
  Task so it survives reboots and firewall reloads, and a verification command.
- The migrate failure message now names this cause and the fix, since that is
  the error an operator actually sees.

Nothing in the stack is at fault here; this is host firewall configuration.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nux3LCu4zP9nih4BRhPyHw

docker/entrypoint.sh

@@ -69,6 +69,15 @@ print(
     f"Last error: {type(last_error).__name__}: {last_error}",
     file=sys.stderr,
 )
+print(
+    "[entrypoint] If this is a Synology NAS: DSM's firewall filters traffic "
+    "between containers (FORWARD -j FORWARD_FIREWALL runs before Docker's own "
+    "rules and denies by default). Fix:\n"
+    "    iptables -I FORWARD 1 -i docker+ -o docker+ -j ACCEPT\n"
+    "See docs/nas-install.md, 'DSM firewall blocks container-to-container "
+    "traffic'.",
+    file=sys.stderr,
+)
 sys.exit(1)
 PYEOF
 }