DNS names: flat franksdank.cloud scheme + dnsmasq LAN DNS on dankclaw

Phase 1 of the local-DNS-name work. Users type a name, not a port.

- dnsmasq quadlet on dankclaw (rootless, slirp4netns, port 53 published):
  serves the flat name scheme from addn-hosts, upstream 1.1.1.1/1.0.0.1.
  Image built from the in-repo Containerfile (localhost/dnsmasq:latest).
- Caddyfiles (both hosts): all *.dankclaw.local / *.dankserver.local vhosts
  renamed to flat <service>.franksdank.cloud. Explicit http:// site
  addresses for now; TLS (wildcard LE via DNS-01/Porkbun) lands in phase 2.
- Drift reconciliation (live /etc/caddy/Caddyfile on dankserver differs
  from the repo): added the live-only llms.franksdank.cloud vhost
  (OpenWebUI on :3000). Dropped the legacy search vhost from dankserver
  (the name belongs to dankclaw's gluetun-routed SearXNG; the legacy
  instance stays reachable at 192.168.0.235:8081).
- Homepage service links updated to the new names.
- New test seams (TDD): tests/dnsmasq.bats (quadlet boot-persistence,
  port 53, conf/record validity, Caddyfile<->addn-hosts cross-check on
  the right host IPs); caddyfile.bats naming-convention tests updated.

LAN clients get this DNS from the SURFboard G36 (DNS Relay -> statically
configured -> 192.168.0.143); the router change is a pending user step.

dankclaw/dnsmasq/dnsmasq.conf

@@ -0,0 +1,24 @@
+# dnsmasq — LAN DNS for the homelab.
+#
+# Runs in a rootless podman quadlet on dankclaw (192.168.0.143) with port 53
+# published to the LAN. Serves the flat franksdank.cloud / franksdank.casa
+# name scheme from addn-hosts (one A record per Caddy vhost); everything else
+# goes to the pinned upstream resolvers. The SURFboard G36 router hands this
+# server out to DHCP clients, so LAN devices resolve service names without
+# per-device config. See docs/Infrastructure/LAN-DNS.md.
+
+# The slirp netns has no useful /etc/resolv.conf; pin upstreams instead.
+no-resolv
+server=1.1.1.1
+server=1.0.0.1
+
+# Local service names (must stay in sync with the Caddyfile vhosts).
+addn-hosts=/etc/dnsmasq/addn-hosts
+
+# Never resolve single-label names or private/bogus ranges as public names.
+domain-needed
+bogus-priv
+
+# Cache.
+cache-size=1000
+neg-ttl=300