docs/home: Document switches/AP must not route

jim, dave and the vibe AP are pure L2, but RouterOS ships ip-forward and
IPv6 forward on, and with IPv6 forwarding enabled it also advertises
itself as a default router. After the 7.18 -> 7.23 upgrade clients began
picking up the switches as IPv6 default routers alongside river.

Replace the earlier advertise-dns framing (which only strips RA options,
not the router lifetime) with the actual requirement: ip-forward=no,
IPv6 forward=no, accept-router-advertisements=no, ra-lifetime=0, and a
re-check after every RouterOS upgrade.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/sites/home/aps.md

@@ -77,6 +77,12 @@ Management uses host `.15`: `192.168.64.15` on native/core as a backup,
 route through its VIP; `untrusted` has no address. With `l2mtu 9214`, `vibe` can use the jumbo
 `hi` network unlike `wave`.
 
+Like the switches, `vibe` is **pure L2 and must not route** — `ip-forward=no`, IPv6 `forward=no`,
+`accept-router-advertisements=no`, `ra-lifetime=0`. RouterOS ships these forwarding-on and then
+advertises itself as an IPv6 router; re-check after any upgrade. See
+[switches.md#switches-must-not-route](switches.md#switches-must-not-route) for the rationale and
+commands.
+
 ## wave (Cudy AX3000, OpenWrt)
 
 Single-port AP, so the port is a VLAN **trunk** carrying management + both SSIDs.