ci: enable Docker NAT for six-peer regression test

[sanity]

Problem

The six-peer regression test was running without Docker NAT simulation, meaning all peers ran as local processes on localhost. This doesn't match production deployment topology where:

• Gateways are on the public internet (no NAT)
• Peers are behind residential NAT routers

This limited test coverage missed bugs like #2202 where NAT peers failed to connect to gateways.

Investigation

I verified empirically that the Docker NAT simulation correctly preserves source IPs:

• Set up Docker networks with a gateway, NAT router, and peer
• Confirmed that when the gateway sends responses, the peer sees the gateway's actual IP as the source
• Standard NAT behavior (MASQUERADE) only rewrites source IP on outbound packets, not on return traffic

This means Docker NAT tests DO exercise the code path where is_known_gateway would be true for gateway responses.

Solution

Enable FREENET_TEST_DOCKER_NAT=1 for the six-peer regression test in CI. This:

• Runs each peer behind a simulated NAT router in Docker
• Runs gateways on the "public" network (no NAT)
• Provides more realistic test coverage for NAT traversal and gateway connection code paths

Notes

The original bug (#2202) had a timing component where responses arrived before ongoing_connections.insert() completed. While Docker NAT doesn't guarantee timing-based bugs will be caught, it does ensure the correct code path is exercised, improving overall test fidelity.

Fixes #2204

[AI-assisted - Claude]