docs(tproxy): document the src_valid_mark=0 prerequisite (silent martian drop)

[Scared-Heart]

What

Adds a warning to the TPROXY listener page (docs/config/inbound/listeners/tproxy.{md,en.md}) documenting a
kernel prerequisite that is easy to get wrong and produces a completely silent failure:

net.ipv4.conf.all.src_valid_mark must be 0.

The sysctl is evaluated as max(conf/all, conf/<iface>), so setting it to 0 for a single interface (e.g.
br-lan) is not enough — conf/all wins. When it is 1, forwarded connections get their fwmark used in the
reverse-path lookup inside fib_validate_source(), land on the local route (RTN_LOCAL) and are dropped as
martian sources by ip_handle_martian_source(), which does not touch any /proc/net/snmp counter and does not
log by default (log_martians=0).

Symptom seen by users:

• all LAN clients lose Internet access (TCP/UDP black hole — DNS still resolves, QUIC/DNS hijack path still works),
• while the router itself keeps working (its own packets already have skb_dst set and never take this check),
• and every log/counter looks healthy (app log, core log, firewall drop counters, InAddrErrors, ListenDrops).

Common trigger: Tailscale 1.98+ (default NetfilterMode=on) writes this sysctl on every startup
(tailscale/tailscale#19796). The only observable evidence on the host is the internal route counter
in_martian_src in /proc/net/stat/rt_cache growing with LAN traffic.

The kernel documentation for src_valid_mark already calls this out:

- 0 - The fwmark of the packet is not included in reverse path route lookup. This allows for asymmetric routing configurations utilizing the fwmark in only one direction, e.g., transparent proxying.

Notes

• Docs only, no code.
• tproxy.ru.md is intentionally not touched — I can't produce a correct Russian translation.
  Happy to have a native speaker follow up, or I can drop the section if the maintainers prefer
  keeping all three languages in sync.
• Verified locally with uv run mkdocs build (both site/config/inbound/listeners/tproxy/ and
  site/en/config/inbound/listeners/tproxy/ render the new admonition).