feat(dns): add GATEWAY_VIP cluster-var for split-horizon target (R-DNS-03)

Parameterize the in-cluster split-horizon target as GATEWAY_VIP (R-ENV-02): base
default = dev L2-announced Gateway VIP (10.73.0.240, first IP of the Cilium LB pool).
coredns-custom answers *.home.keithjackson.dev with ${GATEWAY_VIP} so the unified graph
holds across dev/prod via cluster-vars only. Prod overlay carries a TODO to set the prod
LAN VIP alongside the prod L2 pool range when hardware is built.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/cluster-vars.yaml

@@ -21,6 +21,13 @@ data:
   DNS_ZONE: "keithjackson.dev"              # the actual Cloudflare ZONE (BASE_DOMAIN is a subdomain of it);
                                             # ExternalDNS domain-filter must be the zone, not the subdomain
   ACME_CLUSTER_ISSUER: "letsencrypt-staging" # dev: staging | prod: letsencrypt-prod (ADR-0006)
+  GATEWAY_VIP: "10.73.0.240"                 # in-cluster split-horizon target (R-DNS-01/03): the L2-announced
+                                            # ingress VIP of the `shared` Gateway (first IP of the Cilium
+                                            # LB IP pool 10.73.0.240-.250, platform-config/cilium/l2-ip-pool.yaml).
+                                            # coredns-custom answers *.home.keithjackson.dev with THIS so pod->
+                                            # public-hostname traffic hairpins through the Gateway (correct SNI ->
+                                            # wildcard cert). Base default = dev VIP; a prod overlay must set the
+                                            # prod LAN VIP alongside the prod L2 pool range when hardware is built.
 
   # --- storage (ADR-0003) ---
   LONGHORN_DEFAULT_REPLICA_COUNT: "3"       # default StorageClass replica count (3 on 3 nodes)

clusters/prod/kustomization.yaml

@@ -45,3 +45,7 @@ patches:
         path: /data/VELERO_RETENTION
         value: "720h"
       # TODO(WS-INFRA, Phase 7): pin prod node placement once the bare-metal role labels exist.
+      # TODO(WS-NET, Phase 7): set GATEWAY_VIP to the prod LAN ingress VIP (add a `replace` op here)
+      #   at the same time the prod Cilium LB IP pool range is supplied — the split-horizon
+      #   coredns-custom (platform/coredns) answers *.home.keithjackson.dev with ${GATEWAY_VIP}, so
+      #   the prod value must match the prod pool's Gateway address. Base default is the dev VIP.