feat(mercury): AdGuard Home DNS adblock + DHCP, forwards to unbound

- services/adguardhome.nix: upstream unbound, .sol local domain, DHCP 50-200
- nix-owned config (mutableSettings=false); adlists + dns declared
- mercury imports adguard + unbound; drop the pick-one placeholder block
- TODO: bcrypt admin password, jupiter static lease via UI (needs its MAC)

hosts/mercury/configuration.nix

@@ -6,8 +6,8 @@
 {
   imports = [
     ../../common.nix           # shared base: user / ssh / nix / firewall
-    ../../services/unbound.nix  # local recursive resolver (127.0.0.1:5335)
-    # ../../services/<dns>.nix  # add once the adblock DNS engine is chosen (below)
+    ../../services/unbound.nix      # local recursive resolver (127.0.0.1:5335)
+    ../../services/adguardhome.nix   # DNS adblock + DHCP, forwards to unbound
   ];
 
   networking.hostName = "mercury";
@@ -22,29 +22,12 @@
   ];
   # VERIFY with `ip route` on the Pi — assuming the router is .1.
   networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };
-  # Upstream resolvers for the box itself (the adblock DNS forwards to these).
+  # Resolvers for the Pi's OWN lookups (not the LAN service). Kept public so the
+  # host resolves during boot without depending on its own AdGuard/unbound.
   networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
-  # ---- DNS + adblock + DHCP — pick ONE, then open its ports below ----
-  #
-  # Option A: pihole (native module)
-  #   services.pihole-ftl = {
-  #     enable = true;
-  #     # dhcp, lists, upstreams, local records...
-  #   };
-  #
-  # Option B: AdGuard Home (native module, fully declarative)
-  #   services.adguardhome = {
-  #     enable = true;
-  #     settings = {
-  #       dns.upstream_dns = [ "1.1.1.1" "9.9.9.9" ];
-  #       # filters (adlists), rewrites (local DNS), dhcp static leases...
-  #     };
-  #   };
-  #
-  # Then open the ports this service needs:
-  #   networking.firewall.allowedTCPPorts = [ 53 80 ];   # DNS + web UI
-  #   networking.firewall.allowedUDPPorts = [ 53 67 ];   # DNS + DHCP
+  # DNS adblock + DHCP (AdGuard) and the recursive resolver (unbound) come from
+  # the imported service modules. AdGuard forwards to unbound at 127.0.0.1:5335.
 
   # Do not modify after first flash.
   system.stateVersion = "26.05";