Docs: add IP forwarding/NAT section for client-to-LAN access

The most common OpenVPN deployment scenario is letting remote users
access the server's LAN (office/home network). This requires:
1. net.ipv4.ip_forward=1
2. iptables MASQUERADE on the LAN-facing interface
3. push 'route <LAN-net>' so clients know to send LAN traffic through VPN

Previously this was only mentioned in the FAQ row 'ping不通服务端',
with no actionable instructions. Users (including the project's own
first deployment) hit this exact issue and had to figure it out from
forum posts.

Changes:
  README.md:
  - New section 'IP 转发与内网访问' before 防火墙与公网暴露
  - Covers: enabling ip_forward (immediate + persistent via sysctl.d),
    MASQUERADE rules for one/multiple LAN interfaces, push routes,
    verification commands, troubleshooting table, full checklist
  - FAQ table: add explicit row for 'gateway reachable, LAN not'
  - Features table: add '内网转发' row
  - TOC: link new section

  scripts/install.sh:
  - Auto-enable ip_forward on install (idempotent, persistent via
    /etc/sysctl.d/99-openvpn-manager.conf)
  - Skip silently in containerized environments (no /proc/sys write)
  - Print reminder about manual MASQUERADE rule with link to docs

scripts/install.sh

@@ -172,6 +172,25 @@ for i in 1 2 3 4 5; do
     sleep 1
 done
 
+# ---------- 启用 IP 转发 (客户端访问服务端 LAN 的前提) ----------
+echo "==> 启用 IPv4 转发 (客户端访问服务端 LAN 需要)"
+if [[ -w /proc/sys/net/ipv4/ip_forward ]]; then
+    echo 1 > /proc/sys/net/ipv4/ip_forward
+    # 持久化(下次重启不丢)
+    CONF_FILE="/etc/sysctl.d/99-openvpn-manager.conf"
+    if [[ ! -f "$CONF_FILE" ]] || ! grep -q "^net.ipv4.ip_forward=1" "$CONF_FILE" 2>/dev/null; then
+        echo "net.ipv4.ip_forward=1" > "$CONF_FILE"
+        sysctl -p "$CONF_FILE" >/dev/null 2>&1 || true
+    fi
+    echo "  ✓ IP 转发已启用 (持久化到 $CONF_FILE)"
+    echo "  提示: 如需让客户端访问服务端 LAN 网段, 还需手动添加 iptables NAT 规则:"
+    echo "    sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o <LAN网卡> -j MASQUERADE"
+    echo "  详见 README \"IP 转发与内网访问\" 章节"
+else
+    echo "  ! 无法写入 /proc/sys/net/ipv4/ip_forward (容器环境?) — 跳过"
+    echo "  如需客户端访问服务端 LAN, 请在宿主机启用: sysctl -w net.ipv4.ip_forward=1"
+fi
+
 # ---------- 完成提示 ----------
 cat <<EOF