feat(dns): fleet .internal naming — git-sourced, agent-managed, three resolvers

Names for fleet hosts so addresses stop needing to be memorised. Built because
IPv6 makes that hopeless — and, more to the point, because v6 addresses are
derived rather than assigned, so they cannot reliably be written down once and
trusted either.

  dns/internal.yaml     source of truth: 38 hosts + 4 service aliases
  scripts/dns-sync.py   reconciles AdGuard resolvers against it
  stacks/adguard-ana/   the colo's resolver, which did not exist

Naming is <host>.<site>.internal with sites ana/esh/nh3 (operator's call).
.internal is ICANN-reserved for this; .local is reserved for mDNS, which is
why searxng.pfi.local was a collision that merely happened to work.

Same posture as deploy-stack.sh: file is intent, resolvers are derived state,
you see a diff before anything changes. Every name is published to every
resolver, so the site label says where a host IS, not who knows about it.

Two properties that matter:
- Authority is scoped to the ZONE, not the resolver. ESH carries hand-made
  esteban.net rewrites predating this; they are read, ignored and preserved.
  Resolver-wide authority would have silently deleted them.
- Within .internal it IS authoritative, so UI-added names get removed. That is
  the point — one place to look.

Colo gap closed: ana-docker had no resolver at all (hosts went straight to
1.1.1.1). Its AdGuard runs API on 8053 because 8080/3000 were taken, so the
port is carried per-site in the yaml rather than assumed by the script. It
ships with no blocklists — a false positive on a server network breaks
service-to-service calls for no upside.

Auth is a dedicated infra-ops AdGuard user, not the operator's account,
password vaulted at nh3-dev/adguard-infra-ops-password. Pre-change configs
backed up on each resolver. Both resolvers stayed answering across the restart.

searxng.pfi.local -> searxng.ana.internal, with the old Host() kept alongside
so nothing breaks mid-migration. matrix.pfi.local deliberately NOT migrated: a
Matrix server_name is baked into every user id, room id and signing key, so
renaming it rebuilds the homeserver's identity rather than changing a DNS name.

The v6 column is empty and correct — no fleet host has a global v6 address
yet. The file documents why addresses must be pinned statically before they go
in, since a record that silently stops matching is worse than no record.

stacks/searxng/compose.yaml

@@ -23,7 +23,12 @@ services:
     # ------------------------------------------------------------------
     environment:
       - SEARXNG_SECRET=${SEARXNG_SECRET}
-      - BASE_URL=https://searxng.pfi.local/
+      # searxng.ana.internal, not the old searxng.pfi.local (migrated
+      # 2026-08-19). `.local` is reserved for mDNS, so the old name was a
+      # standards collision that happened to work; `.internal` is ICANN-
+      # reserved for exactly this. The name is served by the fleet's AdGuard
+      # resolvers from dns/internal.yaml — see scripts/dns-sync.py.
+      - BASE_URL=https://searxng.ana.internal/
       - INSTANCE_NAME=SearXNG
     # ------------------------------------------------------------------
     # Resource limits — tune for VM 102's available RAM/CPU
@@ -72,7 +77,12 @@ services:
     labels:
       # Traefik configuration — auto-discovery via Docker provider
       - traefik.enable=true
-      - traefik.http.routers.searxng.rule=Host(`searxng.pfi.local`)
+      # Both names during the migration: `.internal` is the real one now, and
+      # the old `.pfi.local` is kept as a fallback so anything still pointing
+      # at it (a bookmark, a hardcoded config elsewhere) does not break the
+      # day the name changes. Drop the second Host() once nothing uses it —
+      # the Traefik access log will tell you when that is.
+      - traefik.http.routers.searxng.rule=Host(`searxng.ana.internal`) || Host(`searxng.pfi.local`)
       - traefik.http.routers.searxng.entrypoints=websecure
       - traefik.http.routers.searxng.tls=true
       - traefik.http.routers.searxng.service=searxng