docs: igmp-proxy: document firewall requirements and operational commands (backport #2174)

[mergify]

The igmp-proxy page did not document which firewall hooks multicast traffic traverses, and had no coverage of the operational commands. This adds, in reference form:

• A firewall considerations section: the proxy joins the groups itself, so streams and IGMP signaling traverse the input hook, not only forward. Stated as hook-level requirements, not a sample ruleset.
• Sample output and counter interpretation for show ip multicast interface under the Operation opcmd.
• A show log igmp-proxy opcmd documenting two common harmless log messages.
• Two sentences under alt-subnet noting ISP IPTV sources reside on remote private subnets and can change without notice.

Verified against a production VyOS Stream 2026.03 IPTV deployment.

---

This is an automatic backport of pull request #2174 done by Mergify.

[mergify]

Cherry-pick of dad7649 has failed:

On branch mergify/bp/circinus/pr-2174
Your branch is up to date with 'origin/circinus'.

You are currently cherry-picking commit dad76493.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   docs/configuration/protocols/igmp-proxy.md

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[mergify]

Merge Protections

🔴 1 of 1 protections blocking · waiting on 🙋 you

	Protection	Waiting on
🔴	backport-conflict label must be absent to merge	🙋 you

🔴 backport-conflict label must be absent to merge

Waiting for

• label != backport-conflict

This rule is failing.

Block merge while the backport-conflict label is present. The label is auto-applied by the backport action on cherry-pick conflicts and must be manually removed after the conflict is resolved in the PR.

• label != backport-conflict