feat(core): home router NAT after Java, measured with Java FILIUS

The core translates before the IP thread, as Java's NAT threads sit
between card and Ethernet: out, the WAN address and the entry's port (ICMP
keeps its identifier); in, by remote end, port and protocol, else by the
port forwarding, which then makes a dynamic entry; a ping at the WAN
address is answered by the router, packets from outside for the LAN are
dropped, both sides pass the router's firewall, TTL 1 going out gets time
exceeded. Dynamic entries expire at Java's check each second, 300 s times
the delay factor old (55 minutes at 90 %), refreshed only by what comes in.
The home router forwards as a router does.

Measured and not taken: when a LAN endpoint sends to a second remote end,
Java gives it the entry's WAN port but no entry, and the answer stays at
the router; the core adds an entry for each new remote end on that port.

The oracle now records every card of a node (the second card of routers
was missing); the ARP and RIP runs are recorded anew and still match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/java-oracle/README.md

@@ -390,6 +390,12 @@ Port an 42.0.0.30), `tcpOut`, `forward` (von 42.0.0.20 an 42.0.0.10:8080),
 Ein UDP-Server im Werkzeug ist ein aktiver Socket auf Port 7: ein passiver
 trägt seinen Port erst ein, wenn Daten da sind, die vorher nicht ankommen.
 
+`ScenarioNetwork` schreibt seit F2.6 die Frames **jeder** Karte eines Knotens
+(die erste unter der Knoten-ID, weitere unter `id#index`); vorher nur die
+erste, so dass bei Routern und Heimroutern die zweite Karte fehlte. Die
+ARP-, RIP- und NAT-Läufe sind damit neu aufgenommen; die übrigen Knoten haben
+nur eine Karte.
+
 Gemessen (30.09.2026), was der Heimrouter tut (`NatGateway`, dessen
 Threads zwischen Karte und Ethernet-Schicht sitzen):