Add warm-nftset.sh — periodic nftset warmer

Elements in bbrkn_v4/bbrkn_v6 carry a 1d timeout and are only refreshed
when a query reaches the host dnsmasq on :5350, where the nftset=
directives are applied. Idle domains — or ones answered from the pihole
FTL cache — age out of the sets and their traffic silently falls back to
the plain WAN route instead of the tunnel.

warm-nftset.sh re-resolves every domain from the deployed 90-nftset.conf
(base + related subdomains) directly against 127.0.0.1:5350, bypassing
the FTL cache. Sourcing the domain list from the deployed config means
there is no second list to keep in sync.

Ping is off by default: packets originating on the gateway itself go
through OUTPUT, never prerouting_mangle, so they leave unmarked and
almost all time out — a misleading signal, not a real failure.

Run on the gateway via `make warm` or hourly cron. Measured: 1059
domains in ~1m45s at PARALLEL=8, v4 526->2203, v6 305->1440 elements.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -18,7 +18,7 @@ CACHE_TTL_DAYS    ?= 15
 export NFTSET_CONF RESOLVE_CONF CHROME_SERVER DOMAINS_FILE DNS_SERVER NFTSET_TARGET_DIR CACHE_DIR CACHE_TTL_DAYS
 
 # --- Основные цели ---
-.PHONY: all clean cache-clean check generate deploy
+.PHONY: all clean cache-clean check generate deploy warm
 
 all: generate deploy
 	@echo "✅ Конфиги успешно сгенерированы и задеплоены"
@@ -55,3 +55,10 @@ deploy:
 	@echo "🚀 Деплой конфигов в систему"
 	@chmod +x scripts/deploy-to-gateway.sh
 	@./scripts/deploy-to-gateway.sh
+
+# Прогрев nft-сетов. Запускать на шлюзе — читает задеплоенный конфиг и
+# ходит в host-инстанс dnsmasq на 127.0.0.1:5350.
+warm:
+	@echo "🔥 Прогрев nft-сетов"
+	@chmod +x scripts/warm-nftset.sh
+	@./scripts/warm-nftset.sh