dns: fixed 1.1.1.1/8.8.8.8 lockdown + scoped mDNS, esphome sibling container

- deploy.conf: DNS_RESOLVERS, always 1.1.1.1/8.8.8.8, never a WAN's own
  DHCP/RA-provided servers (previously whatever Wapana handed out).
- ap/99-van-router-dns.conf: global resolved config (fixed DNS, Domains=~.,
  global MulticastDNS=yes — a prerequisite for any per-link mDNS to work at
  all, not just an on/off toggle).
- failover/60-van-wan-dns: NM dispatcher that strips each WAN's DNS/search-
  domain and disables its mDNS via resolvectl on every connect/lease event
  (NM's own ipv4/ipv6.ignore-auto-dns can't be set as a config-file default —
  confirmed rejected as an unknown key — so this enforces it directly
  instead), retried over ~5s to beat NM's own async DNS commit. Also logs
  what each WAN advertised, never used, to /run/van-wan-dns/.
- ap/21-van-br0.network: MulticastDNS=yes, scoped to the van's own LAN only
  — .local/mDNS now resolves for ESPHome and other LAN devices without
  leaking mDNS onto Wapana/Starlink/cellular.
- dns/: ZeroTier-managed DNS (zt.wrede.pvt) made reproducible — installed
  the official zerotier-systemd-manager package (verified against upstream
  checksums), additive to the above so *.zt.wrede.pvt keeps resolving over
  the overlay independent of WAN.
- ha/esphome.container: ESPHome dashboard as a sibling Podman Quadlet to
  Home Assistant, same host-network/config-volume pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

dns/zt-search.conf

@@ -0,0 +1,8 @@
+# vim: ft=systemd
+# Adds zt.wrede.pvt as a search domain (bare-hostname completion, e.g.
+# `ssh rosepark` -> rosepark.zt.wrede.pvt) alongside the routing-only
+# ~zt.wrede.pvt entry that zerotier-systemd-manager writes into
+# 99-ztuga7c2kh.network itself (that file is fully manager-owned — don't
+# edit it directly, this .network.d drop-in layers on top instead).
+[Network]
+Domains=zt.wrede.pvt