Add Technitium backup sync automation

docs/architecture/NETWORKING_MODEL.md

@@ -22,7 +22,17 @@
   - `Hotspot` = Guest
 - **Current custom policy additions on top of UniFi defaults:**
   - `Allow Internal to Untrusted`
-  - `Block Untrusted to Gateway Admin Surfaces` (blocks IoT/Camera/Old IoT access to the UDM Pro admin TCP ports while leaving DHCP/DNS/mDNS/internet behavior to the existing zone defaults)
+  - `Block Untrusted to Gateway Admin Surfaces`
+  - `Allow Untrusted to DNS Resolver`
+  - `Block Untrusted to Gateway Default Services`
+  - `Allow Untrusted to Gateway DHCP`
+  - `Allow Untrusted to Gateway mDNS`
+  - explicit `Allow Public DNS` fallbacks
+- **Current DHCP DNS policy:**
+  - `Management`, `Trusted`, `Servers`, `IoT`, `Camera`, and `Old IoT` advertise `10.5.30.8`, `10.5.30.9`, `10.5.30.10`, and `9.9.9.9` via DHCP
+  - `Guest` advertises `9.9.9.9` and `1.1.1.1`
+- **Current hardening result:** every non-guest lane now has three internal Technitium resolvers for both public DNS and the private `home.paccoco.com` zone, plus an external fallback; IoT/Camera/Old IoT keep DNS, DHCP, and mDNS, but general `Untrusted -> Gateway` access and UDM Pro admin-surface access are blocked
+- **Current DNS caveat:** the N.O.M.A.D. (`10.5.30.9`) and Serenity (`10.5.30.10`) Technitium backups are seeded from a cloned PD config. Any future authoritative-zone changes on PD must be resynced or automated so all three resolvers stay aligned
 - **Serenity IP:** 10.5.30.5
 - **N.O.M.A.D. IP:** 10.5.30.7
 - **PlausibleDeniability:** 10.5.30.6 (Servers VLAN)