feat(mesh): headscale control plane + three subnet routers provisioned; DNS entries; plan status

dns/internal.yaml

@@ -101,10 +101,15 @@ hosts:
   - {name: jellyfin,         site: esh, v4: 10.0.50.57,     note: media server}
   - {name: brother,          site: esh, v4: 10.0.90.125,    note: Brother printer}
   - {name: slzb-mr1u,        site: esh, v4: 10.0.90.10,     note: SMLIGHT SLZB-MR1U Zigbee/Thread coordinator (esh-iot VLAN 90, PoE on ESH-Media p4); Home Assistant at 10.0.50.46 connects to tcp/6638}
+  - {name: ana-scale,        site: ana, v4: 10.250.50.45,   note: CT114 on pfi-pve — headscale/tailscale subnet router for 10.250.0.0/16}
+  - {name: nh3-headscale,    site: nh3, v4: 10.100.50.45,   note: CT106 on nh3-pve — headscale control plane (public headscale.phasefinal.com:443)}
+  - {name: nh3-scale,        site: nh3, v4: 10.100.50.46,   note: CT107 on nh3-pve — subnet router for 10.100.0.0/16}
+  - {name: esh-scale,        site: esh, v4: 10.0.50.65,     note: CT108 on esh-pve — subnet router for 10.0.0.0/16}
 
 # Service aliases — a name that points at whatever host currently runs it, so
 # consumers reference the SERVICE rather than the box. Changing where something
 # runs becomes a one-line edit here instead of a hunt through configs.
+
 aliases:
   - {name: searxng,   site: nh3, target: nh3-docker, note: moved off ana-docker 2026-09-03 — colo egress (38.120.12.42) is CAPTCHA-gated by search engines; NH3 egresses residentially}
   - {name: gateway,   site: ana, target: ana-docker, note: LiteLLM gateway :4000}