dns: fixed 1.1.1.1/8.8.8.8 lockdown + scoped mDNS, esphome sibling container

- deploy.conf: DNS_RESOLVERS, always 1.1.1.1/8.8.8.8, never a WAN's own
  DHCP/RA-provided servers (previously whatever Wapana handed out).
- ap/99-van-router-dns.conf: global resolved config (fixed DNS, Domains=~.,
  global MulticastDNS=yes — a prerequisite for any per-link mDNS to work at
  all, not just an on/off toggle).
- failover/60-van-wan-dns: NM dispatcher that strips each WAN's DNS/search-
  domain and disables its mDNS via resolvectl on every connect/lease event
  (NM's own ipv4/ipv6.ignore-auto-dns can't be set as a config-file default —
  confirmed rejected as an unknown key — so this enforces it directly
  instead), retried over ~5s to beat NM's own async DNS commit. Also logs
  what each WAN advertised, never used, to /run/van-wan-dns/.
- ap/21-van-br0.network: MulticastDNS=yes, scoped to the van's own LAN only
  — .local/mDNS now resolves for ESPHome and other LAN devices without
  leaking mDNS onto Wapana/Starlink/cellular.
- dns/: ZeroTier-managed DNS (zt.wrede.pvt) made reproducible — installed
  the official zerotier-systemd-manager package (verified against upstream
  checksums), additive to the above so *.zt.wrede.pvt keeps resolving over
  the overlay independent of WAN.
- ha/esphome.container: ESPHome dashboard as a sibling Podman Quadlet to
  Home Assistant, same host-network/config-volume pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ap/21-van-br0.network

@@ -10,3 +10,7 @@ RequiredForOnline=no
 [Network]
 Address=10.42.0.1/24
 ConfigureWithoutCarrier=yes
+# Resolve .local (mDNS) for devices on the van's own LAN (ESPHome nodes,
+# etc.) — scoped to br0 only, not the WAN links, since mDNS is link-local
+# and that's the only interface those devices are actually on.
+MulticastDNS=yes

ap/99-van-router-dns.conf

@@ -0,0 +1,28 @@
+# Fixed upstream resolvers for this router — see deploy.conf's DNS_RESOLVERS.
+# Never the WAN-provided ones: the failover/60-van-wan-dns NM dispatcher
+# strips each WAN's DHCP/RA-provided DNS from resolved as soon as it appears
+# (NM's own ipv4/ipv6.ignore-auto-dns can't be set as a config-file default —
+# it's rejected as an unknown key there, even though it's a real per-
+# connection property), so these are the only unicast resolvers in play,
+# regardless of whether the WAN is Wapana, Starlink, or cellular.
+# Domains=~. makes them the default route for every query (there being no
+# competing per-link DNS to prioritize over them in the first place).
+#
+# This does NOT affect .local (mDNS) resolution — that's handled separately,
+# per-link, only on br0 (see 21-van-br0.network's MulticastDNS=yes), so
+# ESPHome/other mDNS devices on the van's own LAN still resolve.
+#
+# ZeroTier's own DNS (zt.wrede.pvt, via zerotier-systemd-manager) is a
+# separate, more-specific routing domain on the ztuga7c2kh link and is
+# unaffected by this — resolved always prefers a domain-specific route over
+# the Domains=~. fallback.
+[Resolve]
+DNS=@DNS_RESOLVERS@
+Domains=~.
+# Global default: resolved gates per-link MulticastDNS=yes settings behind
+# this — a link can't enable mDNS on its own if the global default is "no"
+# (confirmed: "Setting mDNS support level yes for X, but the global support
+# level is no"). br0 (21-van-br0.network) opts in; every WAN link is opted
+# back out explicitly by failover/60-van-wan-dns so mDNS stays scoped to the
+# van's own LAN and never leaks onto Wapana/Starlink/cellular.
+MulticastDNS=yes