Move AdGuard to dns.nook.family, fix Agents.md service domains

Agents.md

@@ -124,14 +124,13 @@ Argo CD UI: https://argocd.neuralplatform.ai
 
 ## Services & Domains
 
-### Internal (nook.family — LAN only, AdGuard DNS)
+### Family (nook.family — via Cloudflare tunnel)
 
 | Service | URL | Notes |
 |---------|-----|-------|
-| AdGuard | https://dns.nook.family | DNS + ad blocking |
-| Docker Registry | https://registry.nook.family | Push images here |
+| AdGuard | https://dns.nook.family | DNS + ad blocking (DoH: https://dns.nook.family/dns-query) |
 
-### Public (neuralplatform.ai — via Cloudflare tunnel)
+### Platform (neuralplatform.ai — via Cloudflare tunnel)
 
 | Service | URL | Notes |
 |---------|-----|-------|
@@ -143,6 +142,7 @@ Argo CD UI: https://argocd.neuralplatform.ai
 | Axon webhooks | https://axon.neuralplatform.ai | Webhook hub (port 3847) |
 | npm registry | https://npm.neuralplatform.ai | Verdaccio |
 | PyPI registry | https://pypi.neuralplatform.ai | devpi |
+| Docker Registry | https://registry.neuralplatform.ai | Push images here |
 | Registry UI | https://docker.neuralplatform.ai | Docker registry browser |
 
 ### NodePort services (direct to Legion IP)

servers/legion/adguard.tf

@@ -1,4 +1,4 @@
-# AdGuard Home — household DNS with ad blocking and local nook.family resolution
+# AdGuard Home — household DNS with ad blocking, local resolution, and DoH via dns.nook.family
 
 resource "kubernetes_namespace" "dns" {
   metadata {
@@ -117,12 +117,12 @@ resource "kubernetes_ingress_v1" "adguard" {
 
   spec {
     tls {
-      hosts       = ["dns.${var.domain_suffix}"]
+      hosts       = ["dns.nook.family"]
       secret_name = "adguard-tls"
     }
 
     rule {
-      host = "dns.${var.domain_suffix}"
+      host = "dns.nook.family"
       http {
         path {
           path      = "/"