fix(tailscale-router): scope ts.net forwarder to tailnet subdomain

IPA refuses to create a forward zone for ts.net because it's a real
public TLD with DNSimple nameservers. The forward zone must use the
tailnet-specific subdomain (vars.tailnetDomain, e.g. tail13f623.ts.net)
instead. Update dnsmasq server selector and comments to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ

modules/tailscale/ts-dns-forwarder.nix

@@ -12,9 +12,11 @@
   #
   # Configure FreeIPA once after deploying this host:
   #   kinit admin
-  #   ipa dnsforwardzone-add ts.net \
+  #   ipa dnsforwardzone-add ${vars.tailnetDomain} \
   #     --forwarder=${vars.tailscaleRouterIp} \
   #     --forward-policy=only
+  # Note: IPA refuses to shadow ts.net (a real public TLD); use the
+  # tailnet-specific subdomain (vars.tailnetDomain) instead.
   services.dnsmasq = {
     enable = true;
     settings = {
@@ -33,10 +35,15 @@
       no-resolv = true;
 
       # Tailscale's internal "Quad100" resolver — reachable from any
-      # Tailscale node via the tailscale0 interface. All *.ts.net queries
-      # (MagicDNS hostnames like raspberrypi.tail13f623.ts.net) are
-      # forwarded here exclusively.
-      server = [ "/ts.net/100.100.100.100" ];
+      # Tailscale node via the tailscale0 interface. Scoped to the
+      # specific tailnet subdomain (vars.tailnetDomain) rather than
+      # all of ts.net: FreeIPA refuses to shadow ts.net (a real public
+      # TLD with DNSimple nameservers) so the conditional forward zone
+      # in FreeIPA must use the tailnet-specific subdomain instead:
+      #   ipa dnsforwardzone-add ${vars.tailnetDomain} \
+      #     --forwarder=${vars.tailscaleRouterIp} \
+      #     --forward-policy=only
+      server = [ "/${vars.tailnetDomain}/100.100.100.100" ];
     };
   };