fix(network-go): handle reconnection gracefully and fix DNAT rule issues

- Ignore "endpoint already exists" error in ConnectContainer on re-reconciliation
- Improve iptables comment generation to avoid trailing dashes
- Enhance DNAT rule logic: try multiple selectors and fall back to host rules
- Add missing "-t nat" flag in InsertPreroutingRuleOnInterface

network-go/docker/docker.go

@@ -123,6 +123,10 @@ func (c *Client) ConnectContainer(ctx context.Context, containerName, networkNam
 
 	err := c.cli.NetworkConnect(ctx, networkName, containerName, endpointSettings)
 	if err != nil {
+		// "endpoint with name ... already exists" is expected on re-reconciliation
+		if strings.Contains(err.Error(), "already exists") {
+			return nil
+		}
 		return fmt.Errorf("failed to connect container %s to network %s: %w", containerName, networkName, err)
 	}
 	return nil