Add native DNS-over-TLS (DoT) on dot.nook.family:853

- ddclient.tf: dynamic DNS daemon that keeps dot.nook.family A record
  pointing at the home public IP via Cloudflare API (updates every 5m)
- adguard.tf: cert-manager Certificate for dot.nook.family via DNS-01,
  updated TLS config block with DoT paths and port 853
- apps/adguard.yaml: mount adguard-dot-tls secret, expose port 853,
  init container enforces TLS/DoT settings on every restart
- adguard.tf: fix stale neuralplatform.dev → neuralplatform.ai rewrite

Android Private DNS: set to dot.nook.family
Router: forward TCP 853 → 192.168.68.77

servers/legion/apps/adguard.yaml

@@ -57,8 +57,15 @@ spec:
                       else:
                           cfg.setdefault("filters", []).append(df)
 
-                  # Enforce allow_unencrypted_doh
-                  cfg.setdefault("tls", {})["allow_unencrypted_doh"] = True
+                  # Enforce TLS / DoT settings
+                  cfg.setdefault("tls", {}).update({
+                      "enabled": True,
+                      "server_name": "dot.nook.family",
+                      "port_dns_over_tls": 853,
+                      "certificate_path": "/etc/adguard/tls/tls.crt",
+                      "private_key_path": "/etc/adguard/tls/tls.key",
+                      "allow_unencrypted_doh": True,
+                  })
 
                   # Fix/ensure rewrites
                   cfg.setdefault("filtering", {})
@@ -77,6 +84,9 @@ spec:
               mountPath: /opt/adguardhome/conf
             - name: defaults
               mountPath: /opt/adguard-defaults
+            - name: tls
+              mountPath: /etc/adguard/tls
+              readOnly: true
       containers:
         - name: adguard
           image: adguard/adguardhome:latest
@@ -87,6 +97,9 @@ spec:
             - name: dns-udp
               containerPort: 53
               protocol: UDP
+            - name: dot
+              containerPort: 853
+              protocol: TCP
             - name: http
               containerPort: 3000
               protocol: TCP
@@ -95,6 +108,9 @@ spec:
               mountPath: /opt/adguardhome/conf
             - name: data
               mountPath: /opt/adguardhome/work
+            - name: tls
+              mountPath: /etc/adguard/tls
+              readOnly: true
           resources:
             requests:
               memory: 128Mi
@@ -112,6 +128,9 @@ spec:
         - name: defaults
           configMap:
             name: adguard-defaults
+        - name: tls
+          secret:
+            secretName: adguard-dot-tls
 ---
 apiVersion: v1
 kind: Service