lib: Disable IPv6 privacy addresses on assignments

IPv6 temporary (privacy) addresses rotate an interface's stable source
address out from under long-lived connected sockets. nginx's resolver
on middleman binds a UDP socket to the preferred temporary address at
worker start; once that address expires and is removed, the socket can
no longer send, so every upstream lookup fails with "could not be
resolved (timed out)" until nginx is restarted (which then binds the
next temporary address, so it recurs).

These are servers with no need for privacy addresses, so disable them
in networkdAssignment for every RA-accepting interface.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/default.nix

@@ -149,6 +149,10 @@ rec {
       (optional (a.ipv6.gateway != null) a.ipv6.gateway);
     networkConfig = {
       IPv6AcceptRA = a.ipv6.gateway == null || a.ipv6.iid != null;
+      # These are servers: temporary (privacy) addresses only rotate our stable source
+      # address out from under long-lived connected sockets (e.g. nginx's resolver, which
+      # wedges permanently when the address it bound to expires).
+      IPv6PrivacyExtensions = "no";
       # NOTE: LLDP emission / reception is ignored on bridge interfaces
       LLDP = true;
       EmitLLDP = "customer-bridge";