feat(glyph): expose ntfy on Tailscale interface

Bind ntfy to all interfaces and allow port 2586 on tailscale0 only,
so other hosts on the Tailscale network can publish notifications.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: stackptr

home/secrets/aichat-env.age

@@ -35,10 +35,12 @@ in {
     enable = true;
     settings = {
       base-url = "http://glyph:2586";
-      listen-http = "127.0.0.1:2586";
+      listen-http = ":2586";
     };
   };
 
+  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [2586];
+
   systemd.services.ntfy-slack-relay = {
     description = "Forward ntfy notifications to Slack";
     after = ["ntfy-sh.service" "network.target"];