Adopt nanoDNS-style INI config for the guide gateway

Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on
https://github.com/drakmor/nanoDNS#config: [general] (redirect_url,
allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides]
(mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use
shell-style wildcards and match case-insensitively; resolution order is
exceptions -> overrides -> NXDOMAIN.

The unmatched-name behaviour is deliberately inverted from upstream nanoDNS:
names matching no rule return NXDOMAIN (default-deny) instead of being forwarded,
so PSN, updates and telemetry stay blocked. The source-client allowlist now lives
in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can
point at a mounted file for per-host overrides.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

AGENTS.md

@@ -22,6 +22,8 @@ before including them in an image.
 - `compose.yaml`: hardened local deployment.
 - `docker/server.py`: static HTTP server and security headers.
 - `docker/guide_gateway.py`: restricted DNS plus HTTP/HTTPS User Guide redirect.
+- `docker/nanodns.ini`: nanoDNS-style DNS policy (overrides, exceptions, upstreams,
+  allowed client VLANs) read by `guide_gateway.py`; default-deny for unmatched names.
 - `payloads.sha256`: approved payload digests for the pinned submodule commit.
 - `docs/PS5_SETUP.md`: user and operator guide.
 - `docs/HANDOFF.md`: current infrastructure state and durable session handoff.