Update Pi-hole docs for live HA rollout

docs/planning/DEPLOY_PIHOLE.md

@@ -1,6 +1,6 @@
 # Pi-hole Deployment Plan
 
-**Status:** PD primary stack scaffolded repo-side at `pihole/`; live 3-node rollout still pending replica details and PD-side deployment verification  
+**Status:** PD primary and NOMAD backup are live and working; DNS clients are pointed at VIP `10.5.1.53`. RPi4 remains optional future BACKUP2 work.  
 **Architecture:** 3-node HA cluster with Keepalived VIP, Unbound recursive DNS, Nebula Sync
 
 ---
@@ -32,6 +32,7 @@
 - **Unbound** on each node acts as the local recursive resolver (replaces Cloudflare/Quad9)
 - **Pi-hole** on each node forwards upstream queries to its local Unbound (`127.0.0.1#5335`)
 - **Nebula Sync** (running on PD) syncs all Pi-hole configs from primary → replicas daily
+- Current live replica target is NOMAD at `10.5.1.16:8954`
 
 All nodes use `network_mode: host` for Pi-hole, Unbound, and Keepalived — this is required for Keepalived to manipulate the VIP and for Pi-hole to bind cleanly to port 53.
 
@@ -469,6 +470,12 @@ Point **only the VIP** as DNS:
 
 ---
 
+## Current live endpoints
+
+- **PD admin UI:** `http://10.5.1.6:8953/admin/`
+- **NOMAD admin UI:** `http://10.5.1.16:8954/admin/`
+- **VIP for DNS clients:** `10.5.1.53`
+
 ## Post-Deploy
 
 ### Verify VIP is working
@@ -523,6 +530,8 @@ Nebula Sync will propagate these to all replicas.
 | `pihole.paccoco.com` | `http://10.5.1.6:8953` (primary) |
 | `pihole2.paccoco.com` | `http://10.5.1.16:8954` (N.O.M.A.D.) |
 
+Use `/admin/` on the public hostname for the Pi-hole admin UI path.
+
 Enable Pangolin auth — Pi-hole admin should not be publicly accessible.
 
 ---