fix(mdns): publish via host avahi over D-Bus (not a second daemon)

A container running its own avahi-daemon collides with the host's on :5353.
Instead publish to the host avahi over its mounted D-Bus socket using avahi-tools
(avahi-publish). Needs apparmor=unconfined (docker-default blocks the D-Bus
publish). Documented host prereqs incl. allow-interfaces for multi-bridge hosts.

Tested: publish reaches host avahi and registers the names; on hosts with many
docker bridges avahi self-collides until restricted to the LAN interface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.avahi.yml

@@ -1,7 +1,14 @@
-# mDNS toggle — publish *.local service names over Avahi for zero-config guest
-# resolution. Enabled when ENABLE_MDNS=true in .env (build-stack layers it in)
-# and only meaningful when BASE_DOMAIN=*.local. Host networking is required for
-# link-local multicast.
+# mDNS toggle — publish *.local service names via the HOST's avahi-daemon for
+# zero-config guest resolution. Enabled when ENABLE_MDNS=true in .env and only
+# meaningful when BASE_DOMAIN=*.local.
+#
+# Host prerequisites:
+#   - avahi-daemon running on the host
+#   - if the host has many interfaces (e.g. lots of docker bridges), restrict
+#     avahi to the LAN NIC in /etc/avahi/avahi-daemon.conf:
+#         allow-interfaces=<lan-iface>
+#     otherwise avahi sees its own announcements across bridges → "Local name
+#     collision" and publishing fails.
 services:
   avahi:
     build: ./docker/avahi
@@ -9,6 +16,13 @@ services:
     container_name: avahi
     restart: unless-stopped
     network_mode: host
+    # AppArmor's docker-default profile blocks the D-Bus publish to host avahi.
+    security_opt:
+      - apparmor=unconfined
     environment:
       BASE_DOMAIN: ${BASE_DOMAIN}
       HOST_LAN_IP: ${HOST_LAN_IP}
+      DBUS_SYSTEM_BUS_ADDRESS: "unix:path=/run/dbus/system_bus_socket"
+    volumes:
+      # Talk to the host's avahi-daemon (host must run avahi-daemon).
+      - /run/dbus/system_bus_socket:/run/dbus/system_bus_socket