Add Technitium backup sync automation

docs/architecture/ARCHITECTURE_OVERVIEW.md

@@ -21,7 +21,10 @@ Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and dep
 - **Guest:** 10.5.90.0/24
 - **Legacy quarantine:** 192.168.1.0/24 (`Old IoT`)
 - **UniFi policy zones:** `Internal` = Management + Trusted + Servers, `Untrusted` = IoT + Cameras + Old IoT, `Hotspot` = Guest
-- **Current custom firewall hardening:** `Allow Internal to Untrusted` plus an explicit `Block Untrusted to Gateway Admin Surfaces` rule to keep IoT/Camera/Old IoT clients off the UDM Pro admin TCP ports while leaving the existing zone defaults in place
+- **Current custom firewall hardening:** `Allow Internal to Untrusted`, `Block Untrusted to Gateway Admin Surfaces`, `Allow Untrusted to DNS Resolver`, `Block Untrusted to Gateway Default Services`, `Allow Untrusted to Gateway DHCP`, `Allow Untrusted to Gateway mDNS`, plus explicit public-DNS allows used for fallback
+- **Current DHCP DNS policy:** `Management`, `Trusted`, `Servers`, `IoT`, `Camera`, and `Old IoT` advertise the Technitium trio `10.5.30.8`, `10.5.30.9`, and `10.5.30.10`, followed by external fallback `9.9.9.9`; `Guest` advertises `9.9.9.9` and `1.1.1.1`
+- **Net effect:** every non-guest lane now has three independent internal Technitium resolvers for both public DNS and the private `home.paccoco.com` zone, plus external fallback if all homelab resolvers are down; untrusted lanes still retain DNS, DHCP, and mDNS but no longer have general gateway access or UDM Pro admin-surface access
+- **Current DNS caveat:** the backup Technitium nodes on N.O.M.A.D. (`10.5.30.9`) and Serenity (`10.5.30.10`) start from a cloned PD Technitium config, so future authoritative-zone changes on PD must be resynced or automated to keep all three nodes aligned
 - **Tailscale:** Serenity reachable at 100.94.87.79
 - **NFS:** Serenity exports `/mnt/user/data` and `/mnt/user/immich` → mounted on PD at `/mnt/unraid/` via post-init script
 - **Docker networking:** Cross-stack communication via named external networks (`ai-services`, `ix-databases_shared-databases`)

docs/architecture/NETWORKING_MODEL.md

@@ -22,7 +22,17 @@
   - `Hotspot` = Guest
 - **Current custom policy additions on top of UniFi defaults:**
   - `Allow Internal to Untrusted`
-  - `Block Untrusted to Gateway Admin Surfaces` (blocks IoT/Camera/Old IoT access to the UDM Pro admin TCP ports while leaving DHCP/DNS/mDNS/internet behavior to the existing zone defaults)
+  - `Block Untrusted to Gateway Admin Surfaces`
+  - `Allow Untrusted to DNS Resolver`
+  - `Block Untrusted to Gateway Default Services`
+  - `Allow Untrusted to Gateway DHCP`
+  - `Allow Untrusted to Gateway mDNS`
+  - explicit `Allow Public DNS` fallbacks
+- **Current DHCP DNS policy:**
+  - `Management`, `Trusted`, `Servers`, `IoT`, `Camera`, and `Old IoT` advertise `10.5.30.8`, `10.5.30.9`, `10.5.30.10`, and `9.9.9.9` via DHCP
+  - `Guest` advertises `9.9.9.9` and `1.1.1.1`
+- **Current hardening result:** every non-guest lane now has three internal Technitium resolvers for both public DNS and the private `home.paccoco.com` zone, plus an external fallback; IoT/Camera/Old IoT keep DNS, DHCP, and mDNS, but general `Untrusted -> Gateway` access and UDM Pro admin-surface access are blocked
+- **Current DNS caveat:** the N.O.M.A.D. (`10.5.30.9`) and Serenity (`10.5.30.10`) Technitium backups are seeded from a cloned PD config. Any future authoritative-zone changes on PD must be resynced or automated so all three resolvers stay aligned
 - **Serenity IP:** 10.5.30.5
 - **N.O.M.A.D. IP:** 10.5.30.7
 - **PlausibleDeniability:** 10.5.30.6 (Servers VLAN)