feat(mdns): optional Avahi .local responder (ENABLE_MDNS)

Self-contained host-network Avahi container publishes the service names over
mDNS so .local works zero-config for guests (macOS/Linux native, Windows needs
Bonjour). Toggle with ENABLE_MDNS=true + BASE_DOMAIN=*.local; build-stack layers
docker-compose.avahi.yml in and builds the image during --prep. mDNS can't serve
the air-gap upstream spoofs (non-.local) — those still need real DNS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.avahi.yml

@@ -0,0 +1,14 @@
+# mDNS toggle — publish *.local service names over Avahi for zero-config guest
+# resolution. Enabled when ENABLE_MDNS=true in .env (build-stack layers it in)
+# and only meaningful when BASE_DOMAIN=*.local. Host networking is required for
+# link-local multicast.
+services:
+  avahi:
+    build: ./docker/avahi
+    image: ulicraft-avahi:local
+    container_name: avahi
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      BASE_DOMAIN: ${BASE_DOMAIN}
+      HOST_LAN_IP: ${HOST_LAN_IP}