fix(server): open mountd port 20048 so NFS clients can scan and mount

showmount and the NFSv3 mount protocol need mountd reachable after querying
portmapper on 111; the server was only opening TCP 111 and 2049, causing
clients (e.g. Proxmox GUI NFS storage scan) to time out connecting to
mountd on 20048. Also adds UDP for all three ports — portmapper, nfsd, and
mountd all use both protocols.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

variables.nix

@@ -137,10 +137,14 @@
     # (modules/build-types/pxe-boot.nix).
     pxeBootTftp = 69;
 
-    # `server`'s NFS exports need both the portmapper (rpcbind) and the
-    # NFS data port itself opened (modules/build-types/server.nix).
+    # `server`'s NFS exports: portmapper (rpcbind), NFS data, and the
+    # mountd RPC service (used by showmount/NFSv3 mount protocol).
+    # Mountd listens on a fixed port so the firewall can whitelist it
+    # explicitly rather than opening all of rpcbind's dynamic range.
+    # All three need both TCP and UDP (modules/build-types/server.nix).
     nfsRpcbind = 111;
     nfsd = 2049;
+    nfsMountd = 20048;
 
     # Opened on the docker host's firewall for the Traefik-fronted
     # container stack (docker-compose config lives in the separate