VLAN-aware bridge required for multi-VLAN LXCs

vmbr0 needs `bridge-vlan-aware yes` and `bridge-vids 2-4094` for VLAN tags on container NICs to work. Host traffic stays untagged.

Without VLAN-aware bridging, VLAN tags on container NICs are silently ignored. Discovered during Pi-hole deployment (2026-02-26).
Affected entities:Jack