fix: use IIFNAME instead of OIFNAME in nftables PREROUTING DNAT rule

In the PREROUTING chain, the output interface is not yet determined
(routing hasn't happened), so MetaKeyOIFNAME always returns empty.
This caused the DNAT rule to never match traffic correctly.

Changed to MetaKeyIIFNAME (input interface) to match the behavior of
the iptables implementation which correctly uses `-i tun`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: mtparet

util/linuxfw/nftables_runner.go

@@ -180,7 +180,7 @@ func (n *nftablesRunner) DNATNonTailscaleTraffic(tunname string, dst netip.Addr)
 		Table: nat,
 		Chain: preroutingCh,
 		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
+			&expr.Meta{Key: expr.MetaKeyIIFNAME, Register: 1},
 			&expr.Cmp{
 				Op:       expr.CmpOpNeq,
 				Register: 1,