feat(stack): add AdGuard Home DNS ad-blocking

Deploy AdGuard Home as network-wide DNS ad blocker with:
- Quad9 DoH upstream for encrypted, security-focused DNS
- Web UI on port 3053, DNS on 192.168.86.149:53
- Internal domain: dns.schweitz.internal

Includes setup guide (ADGUARD_SETUP.md) for completing wizard.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

ADGUARD_SETUP.md

@@ -0,0 +1,55 @@
+# AdGuard Home Setup - Remaining Steps
+
+Complete these steps when you're on the local network.
+
+## 1. Setup Wizard
+
+Access: **http://192.168.86.149:3053**
+
+Configure:
+- Admin interface: All interfaces, port **3053**
+- DNS server: All interfaces, port **53**
+- Create admin username/password
+
+## 2. Configure Upstream DNS (Quad9 DoH)
+
+Settings → DNS settings → Upstream DNS servers:
+
+```
+https://dns.quad9.net/dns-query
+```
+
+Enable: **Parallel requests** for faster resolution
+
+## 3. Add Blocklists
+
+Filters → DNS blocklists → Add blocklist:
+
+| List | URL |
+|------|-----|
+| AdGuard DNS filter | (enabled by default) |
+| OADB | `https://raw.githubusercontent.com/ookangzheng/dbl-oisd-nl/master/dbl.txt` |
+| Steven Black | `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts` |
+
+## 4. Configure Router
+
+Set your router's DNS server to: **192.168.86.149**
+
+This makes all devices on the network use AdGuard for DNS.
+
+## 5. Verify
+
+```bash
+# Test DNS resolution
+dig @192.168.86.149 google.com
+
+# Test ad blocking (should return 0.0.0.0 or NXDOMAIN)
+dig @192.168.86.149 ads.google.com
+
+# Test internal domain
+curl http://dns.schweitz.internal/
+```
+
+---
+
+**Delete this file after setup is complete.**