feat(dns): PiHole answers an explicit LAN name list, not a zone wildcard

Public names are proxied CNAMEs to the Cloudflare Tunnel since PR #156 and
work from the LAN, so they should resolve publicly there too. Replace the
address=/${BASE_DOMAIN}/ wildcard with explicit entries: the LAN-only names
(derived from every controller:none HTTPRoute), gitea/nextcloud (off
Cloudflare's 100 MB / 100 s limits), keycloak/auth, and the L4 VIPs.

Add L0 check pihole-lan-names, mutation-tested. Correct docs that still
described public names as CNAME to wan. and the cloudflared entrypoint comment.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/headlamp/httproute.yaml

@@ -20,7 +20,7 @@ metadata:
     homelab.keithjackson.dev/auth-groups: platform-admins
     # LAN/VPN-ONLY (operator decision 2026-11-08). Disowned from external-dns, so the public
     # headlamp record and its TXT are DELETED and nothing republishes them; LAN/VPN clients keep
-    # resolving the name via PiHole's split-horizon wildcard (-> the Gateway VIP). The Cloudflare
+    # resolving the name via PiHole's explicit entry for it (-> the Gateway VIP). The Cloudflare
     # Tunnel also maps headlamp.${BASE_DOMAIN} to http_status:404 (platform/cloudflared/config.yaml).
     # Same mechanism the renderer emits for `exposure: internal` services; asserted by
     # conformance/tests/l0-static/internal-services-publish-no-public-dns (9c).