feat(mercury): pihole via container (native FTL segfaults on aarch64)

- services/pihole.nix: official pihole/pihole:2026.07.2 via podman, host net,
  caps NET_ADMIN/NET_RAW/SYS_NICE/CHOWN; FTLCONF_* env config (upstream unbound,
  DHCP 50-200, static lease jupiter, .sol domain, local records)
- unbound: resolveLocalQueries=false (was hijacking resolv.conf to :53 -> boot
  DNS deadlock; the real root cause of the earlier failures too)
- password via sops FTLCONF env file; /var/lib/pihole created via tmpfiles
- VM-verified: mercury.sol/jupiter.sol/external all resolve, 0 restarts

hosts/mercury/configuration.nix

@@ -31,15 +31,13 @@
   # the imported service modules. pihole forwards to unbound at 127.0.0.1:5335.
 
   # ---- pihole web admin password (from sops) ----
-  # pihole.toml is nix-managed read-only, so `pihole setpassword` can't write it.
-  # Instead pihole-FTL reads FTLCONF_* env vars (they override the toml). Render
-  # an env file from the sops secret and feed it to the service — password stays
-  # out of the repo and the nix store.
+  # The pihole container reads FTLCONF_* env vars. Render an env file from the
+  # sops secret and feed it to the container — password stays out of repo/store.
   sops.secrets.pihole_webpassword = { };
-  sops.templates."pihole-ftl.env".content =
+  sops.templates."pihole.env".content =
     "FTLCONF_webserver_api_password=${config.sops.placeholder.pihole_webpassword}";
-  systemd.services.pihole-ftl.serviceConfig.EnvironmentFile =
-    config.sops.templates."pihole-ftl.env".path;
+  virtualisation.oci-containers.containers.pihole.environmentFiles =
+    [ config.sops.templates."pihole.env".path ];
 
   # Do not modify after first flash.
   system.stateVersion = "26.05";