Document MikroTik OTBR return-route requirements

apps/matter-server/README.md

@@ -11,6 +11,18 @@ LAN interface. The MikroTik OTBR remains the Thread border router; Matter
 Server does not create another Thread network. The WebSocket/dashboard port
 is LAN-only and has no public ingress.
 
+The MikroTik-managed `app-otbr` container requires these startup sysctls in
+its own network namespace: `net.ipv6.conf.all.forwarding=1`,
+`net.ipv6.conf.veth-app-otbr.accept_ra=2`, and
+`net.ipv6.conf.veth-app-otbr.accept_ra_from_local=1`. Its container entrypoint
+applies them before `/init`. Without accepting its own router advertisements,
+the container advertises a LAN prefix but lacks the corresponding return
+route; discovery works while IPv6 communication with Thread fails. Recheck
+this entrypoint after changing or reinstalling the MikroTik App. RouterOS
+does not expose `accept_ra_rt_info_max_plen` in this container kernel.
+The Kubernetes node uses systemd-networkd's router advertisement handling;
+its kernel `accept_ra=0` does not mean IPv6 route learning is disabled.
+
 The chart creates `data-matter-server-0`, mounted at `/data`, on the retained
 `rook-cephfs-ec` storage class. This contains authoritative Matter fabric keys
 and device pairing state. Preserve the entire directory and its permissions