Update network topology: Tailscale routing and DNS proxy, remove Pi-hole

- Document bidirectional LAN ↔ Tailscale routing via tailscale-router
  (static route on router for 100.64.0.0/10, subnet advertisement into Tailnet)
- Document DNS proxy chain: FreeIPA conditional forwarder for *.ts.net
  → tailscale-router → MagicDNS; reverse for *.sweet.home from Tailscale clients
- Remove stale pihole.sweet.home from IP table (decommissioned)
- Fix freeipa role: remove Pi-hole IP from ipa_dns_forwarder, document
  ts.net conditional forwarder as a post-install step
- Fix inventory: remove Pi-hole forwarder IP, add ts.net forwarder note

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

ansible/roles/freeipa/defaults/main.yml

@@ -8,7 +8,12 @@ ipa_domain: "sweet.home"
 # Set these per-host in inventory/hosts.yml:
 # ipa_hostname: "domain-controller.sweet.home"
 # ipa_ip: "192.168.2.253"
-# ipa_dns_forwarder: "192.168.2.138"
+# ipa_dns_forwarder: "<router_gateway_ip>"  # upstream resolver for non-sweet.home queries
+#
+# Note: the conditional forwarder for *.ts.net → tailscale-router (192.168.2.222)
+# is configured post-install via `ipa dnsforwardzone-add tail13f623.ts.net --forwarder=192.168.2.222`.
+# This is what allows LAN clients to resolve Tailscale hostnames through FreeIPA.
+# The NixOS tailscale-router build type configures the other direction automatically.
 
 # Swap file created if no swap exists (FreeIPA needs headroom during install)
 ipa_swap_size_mb: 2048