feat(dns): party-DNS records generator + online/airgap modes

DNS is now your own party server. tooling/dns-records.sh prints the records
(online = service names; airgap = + Mojang/launcher/NeoForge spoofs) in several
formats. build-stack --up online|airgap selects the mirror layer and prints the
matching records. dnsmasq moved to an optional override (docker-compose.dnsmasq.yml).
Default domain switched to .lan (.local is hijacked by mDNS on unicast DNS).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.dnsmasq.yml

@@ -0,0 +1,20 @@
+# Optional turnkey DNS — only if you DON'T run your own party DNS server.
+# Layer on: `docker compose -f docker-compose.yml -f docker-compose.dnsmasq.yml ... up -d`.
+# Serves dnsmasq/dnsmasq.conf (rendered from the template, includes the airgap
+# spoof records). If you have your own DNS, skip this and use the records from
+# `tooling/dns-records.sh` instead.
+services:
+  dnsmasq:
+    image: jpillora/dnsmasq
+    container_name: dnsmasq
+    restart: unless-stopped
+    ports:
+      # Bind DNS to the host LAN IP so it doesn't clash with systemd-resolved on :53.
+      - "${HOST_LAN_IP}:53:53/udp"
+      - "${HOST_LAN_IP}:53:53/tcp"
+    volumes:
+      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
+    networks:
+      - mcnet
+    # webproc UI (:8080) can be exposed behind Caddy as dns.${BASE_DOMAIN};
+    # guard with HTTP_USER / HTTP_PASS.