docs: Document NAT reflection fix for internal service access

- Pure NAT mode doesn't work when clients/servers on same subnet
- Must use enablenatreflectionhelper for proper source NAT
- Added to Common Gotchas in DECISIONS.md

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -192,6 +192,7 @@ cat /tmp/rules.debug
 4. NAT port range rules: `<local-port>` must be just the starting port, not the full range
    - Correct: `<port>2223-2323</port>` with `<local-port>2223</local-port>`
    - Wrong: `<port>2223-2323</port>` with `<local-port>2223-2323</local-port>` (rule will be commented out)
+5. NAT reflection requires `enablenatreflectionhelper` (not just purenat) when clients and servers are on the same subnet - pure NAT doesn't source-NAT so return traffic bypasses OPNsense
 
 ### Reverse Proxy