Update network topology: Tailscale routing and DNS proxy, remove Pi-hole

- Document bidirectional LAN ↔ Tailscale routing via tailscale-router
  (static route on router for 100.64.0.0/10, subnet advertisement into Tailnet)
- Document DNS proxy chain: FreeIPA conditional forwarder for *.ts.net
  → tailscale-router → MagicDNS; reverse for *.sweet.home from Tailscale clients
- Remove stale pihole.sweet.home from IP table (decommissioned)
- Fix freeipa role: remove Pi-hole IP from ipa_dns_forwarder, document
  ts.net conditional forwarder as a post-install step
- Fix inventory: remove Pi-hole forwarder IP, add ts.net forwarder note

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

ansible/inventory/hosts.yml

@@ -33,7 +33,9 @@ all:
           ipa_domain: "sweet.home"
           ipa_hostname: "domain-controller.sweet.home"
           ipa_ip: "192.168.2.253"
-          ipa_dns_forwarder: "192.168.2.138"  # Pi-hole
+          # ipa_dns_forwarder: set to router gateway IP before running freeipa role
+          # Post-install: add ts.net conditional forwarder manually:
+          #   ipa dnsforwardzone-add tail13f623.ts.net --forwarder=192.168.2.222
           ansible_python_interpreter: /usr/bin/python3
 
     # ── Edge / monitoring ─────────────────────────────────────────────────────