DNS names: flat franksdank.cloud scheme + dnsmasq LAN DNS on dankclaw

Phase 1 of the local-DNS-name work. Users type a name, not a port.

- dnsmasq quadlet on dankclaw (rootless, slirp4netns, port 53 published):
  serves the flat name scheme from addn-hosts, upstream 1.1.1.1/1.0.0.1.
  Image built from the in-repo Containerfile (localhost/dnsmasq:latest).
- Caddyfiles (both hosts): all *.dankclaw.local / *.dankserver.local vhosts
  renamed to flat <service>.franksdank.cloud. Explicit http:// site
  addresses for now; TLS (wildcard LE via DNS-01/Porkbun) lands in phase 2.
- Drift reconciliation (live /etc/caddy/Caddyfile on dankserver differs
  from the repo): added the live-only llms.franksdank.cloud vhost
  (OpenWebUI on :3000). Dropped the legacy search vhost from dankserver
  (the name belongs to dankclaw's gluetun-routed SearXNG; the legacy
  instance stays reachable at 192.168.0.235:8081).
- Homepage service links updated to the new names.
- New test seams (TDD): tests/dnsmasq.bats (quadlet boot-persistence,
  port 53, conf/record validity, Caddyfile<->addn-hosts cross-check on
  the right host IPs); caddyfile.bats naming-convention tests updated.

LAN clients get this DNS from the SURFboard G36 (DNS Relay -> statically
configured -> 192.168.0.143); the router change is a pending user step.

dankclaw/dnsmasq/Containerfile

@@ -0,0 +1,4 @@
+# Minimal dnsmasq image for the LAN DNS quadlet (dankclaw).
+# Build on dankclaw:  podman build -t localhost/dnsmasq:latest -f Containerfile .
+FROM alpine:3.20
+RUN apk add --no-cache dnsmasq

dankclaw/dnsmasq/addn-hosts

@@ -0,0 +1,34 @@
+# A records for the flat franksdank.name scheme (dnsmasq addn-hosts format:
+# <IP> <name> [<name> ...]). Every Caddy vhost name has exactly one record,
+# pointing at the host that runs it. Keep in sync with the Caddyfiles
+# (tests/dnsmasq.bats cross-checks this).
+#
+#   192.168.0.235 = dankserver (media/library stack)
+#   192.168.0.143 = dankclaw   (AI/search/dev stack)
+
+# --- dankserver services ---
+192.168.0.235 dankserver.franksdank.cloud
+192.168.0.235 plex.franksdank.cloud
+192.168.0.235 plex.franksdank.casa
+192.168.0.235 books.franksdank.cloud
+192.168.0.235 llms.franksdank.cloud
+192.168.0.235 romm.franksdank.cloud
+192.168.0.235 files.franksdank.cloud
+192.168.0.235 jellyfin.franksdank.cloud
+192.168.0.235 radarr.franksdank.cloud
+192.168.0.235 sonarr.franksdank.cloud
+192.168.0.235 lidarr.franksdank.cloud
+192.168.0.235 readarr.franksdank.cloud
+192.168.0.235 prowlarr.franksdank.cloud
+192.168.0.235 qbittorrent.franksdank.cloud
+
+# --- dankclaw services ---
+192.168.0.143 dankclaw.franksdank.cloud
+192.168.0.143 search.franksdank.cloud
+192.168.0.143 comfyui.franksdank.cloud
+192.168.0.143 chat.franksdank.cloud
+192.168.0.143 hermes.franksdank.cloud
+192.168.0.143 gitea.franksdank.cloud
+192.168.0.143 grafana.franksdank.cloud
+192.168.0.143 prometheus.franksdank.cloud
+192.168.0.143 loki.franksdank.cloud

dankclaw/dnsmasq/dnsmasq.conf

@@ -0,0 +1,24 @@
+# dnsmasq — LAN DNS for the homelab.
+#
+# Runs in a rootless podman quadlet on dankclaw (192.168.0.143) with port 53
+# published to the LAN. Serves the flat franksdank.cloud / franksdank.casa
+# name scheme from addn-hosts (one A record per Caddy vhost); everything else
+# goes to the pinned upstream resolvers. The SURFboard G36 router hands this
+# server out to DHCP clients, so LAN devices resolve service names without
+# per-device config. See docs/Infrastructure/LAN-DNS.md.
+
+# The slirp netns has no useful /etc/resolv.conf; pin upstreams instead.
+no-resolv
+server=1.1.1.1
+server=1.0.0.1
+
+# Local service names (must stay in sync with the Caddyfile vhosts).
+addn-hosts=/etc/dnsmasq/addn-hosts
+
+# Never resolve single-label names or private/bogus ranges as public names.
+domain-needed
+bogus-priv
+
+# Cache.
+cache-size=1000
+neg-ttl=300

dankclaw/dnsmasq/dnsmasq.container

@@ -0,0 +1,32 @@
+# Quadlet unit: dnsmasq LAN DNS (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/dnsmasq.container
+# Unit name: dnsmasq.service (container name: dnsmasq)
+#
+# The LAN's authoritative DNS for the flat franksdank.cloud / franksdank.casa
+# name scheme. It serves A records from addn-hosts (one per Caddy vhost) and
+# forwards everything else to pinned upstream resolvers. The SURFboard G36
+# router hands this server out to DHCP clients (DNS Relay -> statically
+# configured -> 192.168.0.143), so no client needs per-device config.
+#
+# Runs on slirp4netns with port 53 published to the LAN (the same pattern as
+# open-webui). Config mounts from /opt/dnsmasq. See docs/Infrastructure/LAN-DNS.md.
+
+[Unit]
+Description=dnsmasq LAN DNS container
+After=network.target
+
+[Container]
+ContainerName=dnsmasq
+Network=slirp4netns
+Image=localhost/dnsmasq:latest
+PublishPort=53:53/tcp
+PublishPort=53:53/udp
+Volume=/opt/dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
+Volume=/opt/dnsmasq/addn-hosts:/etc/dnsmasq/addn-hosts:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=default.target