<sigh>
I figured out the root cause. Somewhere in the midst of all of this, my cable modem got a new IP address. This usually doesn't happen more than once every 12-18 months, but I rebooted the modem yesterday, and that apparently triggered it. I have external monitoring that would normally have warned me to change the DNS entry, but of course that had already started complaining when I took the old router offline and I ignored it.
Once I was actually testing against the correct public IP address, everything worked as I expected. I was able to set up forwarding directly to the guest on 192.168.2.2:22 and 192.168.2.2:80, and now HTTP and SSH work like they did before.
I'm rather embarrassed that I didn't think to check this sooner. I appreciate all of your help in debugging the problem, even if in the end it was entirely my fault.
In case anyone else is looking at this thread, the qemu and network hooks were no longer required once I figured out what was going on.