pihole: split-horizon — forward demo-felhom.eu to the felhom-pve host resolver

The stale `address=/demo-felhom.eu/192.168.0.162` pinned A to the host (pre-Proxmox
era, when the host ran traefik) and forwarded AAAA upstream → Cloudflare (split-brain),
so LAN clients hit 192.168.0.162:443 (nothing there) → ERR_CONNECTION_REFUSED.
Switch to a conditional forward `server=/demo-felhom.eu/192.168.0.162` so the Pi-hole
relays the zone to the felhom-agent-managed dnsmasq on the host, which answers the
guest's live IP (192.168.0.151) + AAAA NODATA and tracks the DHCP IP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

helm/pihole/values.yaml

@@ -54,7 +54,11 @@ serviceDns:
   type: LoadBalancer
 dnsmasq:
   customDnsEntries:
-    - address=/demo-felhom.eu/192.168.0.162
+    # Split-horizon for the Felhom demo: CONDITIONAL FORWARD the whole zone to the felhom-pve host's
+    # agent-managed dnsmasq (192.168.0.162:53), which answers *.demo-felhom.eu with the guest's LIVE
+    # LAN IP (A) and NODATA for AAAA (no Cloudflare-IPv6 split-brain). `server=` (not `address=`) so
+    # BOTH A and AAAA are forwarded, and the guest's DHCP IP is tracked by the agent — not pinned here.
+    - server=/demo-felhom.eu/192.168.0.162
 replicaCount: 1
 dns:
   adlist: