Restore CI cache connectivity from Docker jobs on 5.9.138.8

Investigate setup-node Yarn cache ETIMEDOUT after gitea/runner migration on 5.9.138.8. Node download succeeded; cache restore failed. Runner cache uses automatic host and random ports in host-network runner containers. Host INPUT firewall drops all except SSH, ICMP, monitoring and established connections; Docker bridge input is not allowed. Reproduce from a disposable bridge container, identify exact advertised cache endpoint, then implement narrow persistent connectivity without exposing cache publicly or disrupting production. Reuse Ansible firewall source if available; avoid unmanaged broad firewall exceptions. Verify cache request from bridge and ideally cache save/restore. Preserve CPU priorities and registrations; do not claim full CI passes without evidence. Verified diagnosis and fix: disposable Docker bridge container timed out against both original listening cache ports (43823/40239), via Docker gateway and public address. INPUT jumped to deny-by-default ANSIBLE-FIREWALL-IN without cache access; UFW was inactive but iptables active. Both runner YAML files now advertise 172.17.0.1, fixed ports 9109 (gitea) / 9110 (Pi), and use /data/cache in existing persistent registration volumes. Added only TCP ports 9109/9110 from source 172.16.0.0/12 to live INPUT chain and /usr/local/sbin/apply-ansible-firewall; boot firewall service verified enabled. Remote configs/script backed up with 20261022T124013Z suffix. Restarted only CI runners; they declared successfully and retain weight=1/unlimited CPU; production Teams/video start times unchanged. Durable source: /home/mathias/work/kaukus/Ansible/host_vars/gpu.yml newly added (uncommitted); matches the live script's source/port allow rules. Repository was clean before editing. Ansible playbook syntax check, strict firewall template render for GPU, shell syntax validation, and git diff checks pass. No broad public cache port allowance added; remaining default deny retained. Validation: from disposable Docker bridge container, POST to each actual cache v2 GetCacheEntryDownloadURL endpoint now returns immediate HTTP 401 missing bearer token, proving TCP/HTTP connectivity rather than timeout. No authentication token exposed. User confirmed the reported CI cache issue is fixed after rerunning. Exact save/restore logs and overall full-CI result were not independently inspected.