fix(pxe-boot): open UDP 4011 for PXE boot service discovery

After the proxy DHCP handshake, the UEFI client queries the PXE boot
server on UDP port 4011 to get the actual boot filename. This port was
not open in the NixOS firewall, so all four PXE discovery attempts from
the test VM silently timed out. dnsmasq was bound to 0.0.0.0:4011 but
never received the packets.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/build-types/pxe-boot.nix

@@ -447,5 +447,5 @@ in
   };
 
   networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
-  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 4011 ];
 }