Hah, figured it out, albeit in a messy way: Passing "--enable-static --disable-shared" builds a fully static iptables binary with all extensions included, which turns out way too big of a binary. However, one can just remove unneeded extension source files from the extensions directory in the iptables sources and iptables builds happily without them.
Switching to a i486-linux-musl toolchain also brought the free space up to 35 whole kilobytes! Whoa! Maybe enough for a simple web UI with httpd?
