feat(dns): split-horizon in-cluster DNS via coredns-custom (R-DNS-01/R-DNS-03)

In-cluster clients resolving a platform hostname over its PUBLIC name got the
off-cluster answer, so pod->keycloak.home.keithjackson.dev hit a path that does not
serve the *.home.keithjackson.dev SNI -> `tls: unrecognized name` (oauth2-proxy OIDC
discovery crash; Grafana generic_oauth would hit the same wall).

Add a GitOps-managed coredns-custom ConfigMap (kube-system) that k3s CoreDNS imports as
a `*.server` block. The template plugin answers the whole home.keithjackson.dev zone with
${GATEWAY_VIP} (the shared Gateway VIP), so pod->public-hostname traffic hairpins through
the Gateway with the correct SNI -> wildcard cert validates. CoreDNS reloads the ConfigMap
live (no pod restart). Wired into platform/kustomization.yaml (Phase 2 network core).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/coredns/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# platform/coredns — in-cluster split-horizon DNS (R-DNS-01 / R-DNS-03).
+# A single `coredns-custom` ConfigMap in kube-system that k3s CoreDNS imports as an extra server
+# block (see coredns-custom.yaml). Rendered by the `platform` Flux Kustomization, which supplies
+# ${GATEWAY_VIP} via substituteFrom cluster-vars (R-ENV-02).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - coredns-custom.yaml