AGNOS kernels (4.9, CONFIG_NF_TABLES not set — verified in upstream AGNOS
boot image) cannot run NetworkManager's shared-mode firewall rules, so
tethered clients get DHCP but no WAN access.
Idempotently apply masquerade/forward rules via iptables-legacy on every
hotspot activation path (UI toggle, autoconnect fallback, boot restore),
replacing a manually re-installed systemd service after each AGNOS update.
Zikeji