fix(esh-docker-vm): /32 route to Home Assistant over macvlan-shim

The shim holds 10.0.50.47/24, which gives two equal connected 10.0.50.0/24 routes,
and ens18's wins. Host-to-HA traffic therefore left via the macvlan parent and was
dropped. HA lost MQTT to the broker on this host on 2026-08-19, 2026-09-21 and
2026-09-25 (the last lasted two days). This adds an ifupdown if-up.d hook that
routes 10.0.50.46/32 via macvlan-shim; /etc/network/interfaces is not edited.
Verified: the route resolves via the shim, the host pings HA, HA reaches :1883,
and HA reconnected to the broker. Diagnosis by ha-dev.

Also corrects the zigbee2mqtt acceptance note, which had wrongly reported HA as
connected.

stacks/zigbee2mqtt/README.md

@@ -47,8 +47,11 @@ device must be re-paired. It must never be in git. That is why this repo holds o
   is kept as `configuration_backup_v4.yaml`.
 - Frontend: HTTP 200. The websocket accepts the vault token, and closes with `4401 Unauthorized`
   on a wrong token or no token.
-- Broker: the new user is accepted, a wrong password is refused, and the reload disconnected no
-  one. Afterwards 3 clients were connected (HA, the `denspots` Tasmota, Z2M). The Tasmotas
+- Broker: the new user is accepted, and a wrong password is refused. ⚠ **Correction (1250):** I first
+  reported HA's MQTT client as connected. It was not. HA had lost the broker at 2026-09-25 06:13,
+  because host→HA traffic left via ens18 instead of the macvlan shim (ha-dev diagnosed it). The
+  third "client" I counted was my own probe. Fixed by `playbooks/esh-docker-vm-macvlan-shim-route.yaml`,
+  a /32 route to 10.0.50.46 over macvlan-shim. HA reconnected at 1249. The Tasmotas
   `consoletree`, `fireplacetree` and `mantlelights` show LWT `Offline`, but they have not connected
   at any point in the broker's current log (back to 2026-09-09), so that predates this change.