serving: document opening 123/udp on the host firewall for the NTP server

The ntp service is host-networked, so (like the audit collector's 514/tcp)
Docker doesn't open the port — the serving host's own ufw/firewalld governs
123/udp. Without a rule, workstations are handed 192.168.50.10 as their NTP
server via DHCP opt 42 but their packets are dropped: chrony logs 'Added source
… / unreachable' and never syncs (seen on comet-beacon-54). Add the boot-LAN
firewall rule to the ntp service NOTE, mirroring the audit-collector README.

serving/docker-compose.yml

@@ -268,6 +268,14 @@ services:
     # HOST clock (the clock isn't namespaced) — intended: the serving host is the
     # lab time source. Drop SYS_TIME (and add `chronyd -x`) if the host already
     # runs its own NTP and you only want this to relay.
+    #
+    # FIREWALL (easy to miss — same trap as the audit collector's 514/tcp): host
+    # networking means Docker does NOT open the port; the serving host's own
+    # firewall governs 123/udp. Without a rule, workstations get 192.168.50.10 as
+    # their NTP server (DHCP opt 42) but their packets are dropped — chrony logs
+    # "Added source … / unreachable" and never syncs. Open it on the boot-LAN NIC:
+    #   ufw:       sudo ufw allow in on <boot-nic> to any port 123 proto udp comment 'fleet NTP'
+    #   firewalld: sudo firewall-cmd --permanent --add-service=ntp && sudo firewall-cmd --reload
 
   # --- Remote audit / log collector (RECEIVE side) ---------------------------
   # rsyslog receiver: booted diskless hosts (whose RAM-only overlay root loses