fix(tor): move the egress virtual range out of the docker address pool

TOR_EGRESS_VIRTUAL_NET_IPV4 was Tor's upstream default 10.192.0.0/10, which
spans 10.192.0.0 to 10.255.255.255 and therefore contains the whole docker
pool that 08_networks.yml allocates as 10.208.0.0/12.

The value drives an iptables rule in svc-net-tor/tasks/router.yml that
REDIRECTs TCP for that range into Tor's TransPort. With the ranges
overlapping, every connection from the controller to a container IP or to
the docker bridge gateway was captured and handed to Tor, which has no
mapping for a private address and resets it. The failure surfaced as
`errno 104 Connection reset by peer` against containers that had been up
for tens of minutes without a restart, and it reached anything addressing a
container through DOCKER_REACH_HOST, not just the LDAP schema load where it
was first seen.

Move the virtual range to 10.240.0.0/12, which sits above the docker pool.
Nothing else in group_vars or roles allocates the upper 10/8 space.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

group_vars/all/19_tor.yml

@@ -2,6 +2,6 @@
 TOR_ONION_SSH_ENABLED: true
 
 TOR_EGRESS_ROUTER_ENABLED: true
-TOR_EGRESS_VIRTUAL_NET_IPV4: "10.192.0.0/10"
+TOR_EGRESS_VIRTUAL_NET_IPV4: "10.240.0.0/12"
 
 TOR_ONION_EXTRA_PORTS: "{{ ([{'onion_port': 22, 'target': '127.0.0.1:22'}] if (TOR_ONION_SSH_ENABLED | bool) else []) + lookup('tor_ports') }}"