docs: LAN-access ssh-lan.conf + DEVBOX_LAN_AUTOJUMP_PRIVATE (inherited from base)

setup-lan-access.sh fixes (Include scope, ControlPath) + ssh-lan.conf and
RFC1918 autojump flow in via FROM base-pi-only. Documents the knob and new
host-owned config. Tag v0.78.0c AFTER opencode-devbox v1.15.13d publishes the
rebuilt base-pi-only, so it doesn't build on the stale base.

.env.example

@@ -12,9 +12,11 @@ SSH_KEY_PATH=~/.ssh
 # ── LAN access from the container (host-OS-agnostic) ─────────────────
 # On VM-backed hosts (macOS OrbStack / Docker Desktop) the container can't
 # reach the host's directly-attached LAN peers by default. The entrypoint
-# then sets up the host as an SSH jump (use the `dssh` alias, or add
-# `ProxyJump host` to targets in your bind-mounted ~/.ssh/config). On native
-# Linux Docker the LAN is reachable directly and this is a no-op.
+# then sets up the host as an SSH jump (use the `dssh` alias). Reach the host
+# with `dssh host`; for named LAN peers put `ProxyJump host` overrides in a
+# host-owned ~/.config/devbox-shell/ssh-lan.conf (bind-mounted in) rather than
+# editing ~/.ssh/config. On native Linux Docker the LAN is reachable directly
+# and this is a no-op.
 # See the opencode-devbox README for the full walkthrough.
 #
 # DEVBOX_LAN_ACCESS: auto (default) | jump | off
@@ -22,6 +24,9 @@ SSH_KEY_PATH=~/.ssh
 # HOST_SSH_USER: your username on the host (required for the jump). On first
 # start the entrypoint prints the public key to authorize on the host.
 # HOST_SSH_USER=
+# DEVBOX_LAN_AUTOJUMP_PRIVATE: 1 = ProxyJump any private (RFC1918) IP through
+# the host, so bare `dssh user@<ip>` works on whatever LAN you're roaming on.
+# DEVBOX_LAN_AUTOJUMP_PRIVATE=0
 
 # ── Git Configuration ────────────────────────────────────────────────
 GIT_USER_NAME=