feat(mercury): switch to pihole-ftl (declarative static leases)

- services/pihole.nix: DNS adblock + DHCP, upstream unbound, .sol domain,
  jupiter static lease 00:e0:4c:3c:a3:1f -> 10.0.0.20 (declarative!)
- drop services/adguardhome.nix; mercury imports pihole
- admin password set via 'pihole setpassword' post-boot (not in repo)

services/pihole.nix

@@ -0,0 +1,46 @@
+{ ... }:
+
+# Pi-hole (pihole-FTL v6) — network DNS (adblock) + DHCP, with the embedded
+# web UI. Forwards to the local unbound recursive resolver (services/unbound.nix).
+#
+# `settings` is the raw pihole.toml. Static DHCP leases ARE declarative here
+# (settings.dhcp.hosts, dnsmasq "MAC,IP,hostname" format) — the reason we chose
+# pihole over AdGuard.
+#
+# ⚠️ The pihole-ftl NixOS module + pihole.toml v6 schema are new; VALIDATE this
+# at runtime (VM or the Pi) before trusting it — eval only checks the module,
+# not the freeform TOML keys.
+{
+  services.pihole-ftl = {
+    enable = true;
+    openFirewallDNS = true;
+    openFirewallDHCP = true;
+    openFirewallWebserver = true;
+
+    lists = [
+      { url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; type = "block"; }
+    ];
+
+    settings = {
+      dns = {
+        upstreams = [ "127.0.0.1#5335" ];   # local unbound (recursive)
+        domain = "sol";                       # local domain -> jupiter.sol etc.
+      };
+
+      dhcp = {
+        active = true;
+        start = "10.0.0.50";
+        end = "10.0.0.200";
+        router = "10.0.0.1";
+        leaseTime = "1h";
+        # Static leases (declarative). Format: "MAC,IP,hostname".
+        hosts = [ "00:e0:4c:3c:a3:1f,10.0.0.20,jupiter" ];
+      };
+
+      # Embedded web UI on :80. Set the admin password once after first boot:
+      #   sudo pihole setpassword    (kept out of the repo)
+      # (plain "80" so the module's openFirewall port parser is happy.)
+      webserver.port = "80";
+    };
+  };
+}