docs(freeipa): update IPs and remove Pi-hole references

- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs)
- cloud-init nameserver and nmcli DNS during install use .254 (gateway)
  since IPA isn't running yet at that point
- --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone)
- Remove Step 7 (Pi-hole DNS forwarding config) from install.md
- Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh
- Update CLAUDE.md section count and freeipa/ guidance entry
- Update freeipa/README.md IP and DNS forwarding description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -6,8 +6,9 @@ OVERRIDE any default behaviour and must be followed exactly.
 ## Repo purpose
 
 Configuration toolsets and docs for Wayne's Debian-based LAN machines.
-Two sections currently exist: `proxmox/` (Proxmox VE hosts) and
-`pihole/` (Pi-hole DNS/DHCP). Each has its own README.
+Three sections currently exist: `proxmox/` (Proxmox VE hosts),
+`pihole/` (Pi-hole DNS/DHCP), and `freeipa/` (FreeIPA identity
+management). Each has its own README.
 
 ## Safety rules (apply everywhere in this repo)
 
@@ -35,6 +36,10 @@ Two sections currently exist: `proxmox/` (Proxmox VE hosts) and
   rules above. `apply-config.sh` is the only script that touches a live
   host; treat its `<dest-host>` argument as production unless you're
   explicitly testing on a throwaway instance.
+- **FreeIPA:** `freeipa/` documents and scripts for the FreeIPA identity
+  management server (`domain-controller.sweet.home`, VMID 108 on `pve1`).
+  All scripts that SSH into the server are production operations — treat
+  them as off-limits without an explicit same-session go-ahead.
 
 ## Adding a new machine type