feat(dns): party-DNS records generator + online/airgap modes

DNS is now your own party server. tooling/dns-records.sh prints the records
(online = service names; airgap = + Mojang/launcher/NeoForge spoofs) in several
formats. build-stack --up online|airgap selects the mirror layer and prints the
matching records. dnsmasq moved to an optional override (docker-compose.dnsmasq.yml).
Default domain switched to .lan (.local is hijacked by mDNS on unicast DNS).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -1,10 +1,19 @@
 # Copy to .env and fill in real values
 
 # Single base domain for the whole stack; every service is a subdomain of this.
-BASE_DOMAIN=ulicraft.local
-# The Docker host's LAN IP — dnsmasq points *.BASE_DOMAIN here for guest laptops.
+# Use .lan (NOT .local) — .local is intercepted by mDNS on macOS/Linux and
+# won't resolve through a normal unicast DNS server.
+BASE_DOMAIN=ulicraft.lan
+# The Docker host's LAN IP — every service name resolves here.
 HOST_LAN_IP=192.168.1.10
 
+# mDNS toggle. true + BASE_DOMAIN=*.local → an Avahi container publishes the
+# service names over mDNS (zero-config for macOS/Linux guests; Windows needs
+# Bonjour). false → use your own party DNS (records: tooling/dns-records.sh).
+# NOTE: mDNS resolves ONLY *.local; it cannot serve the air-gap upstream-host
+# spoofs — those always need a real DNS server.
+ENABLE_MDNS=false
+
 RCON_PASSWORD=change-me-to-something-random
 # Only needed if using CurseForge-exclusive mods:
 # CF_API_KEY=your-curseforge-api-key