Migrate bbrkn from legacy ipset to nftables sets

The gateway (Archie) routes bbrkn domains via nft sets bbrkn_v4/bbrkn_v6
(inet filter), not the legacy ipset. bbrkn was still emitting dead
`ipset=/domain/bbrkn` directives (no such ipset exists) plus a 92-resolve
pointing at 8.8.8.8, both overridden by hand-maintained files on the host.
This makes bbrkn the generator of record for the real scheme.

generate-configs.sh:
- emit `nftset=/domain/$NFTSET_SPEC` (default 4#inet#filter#bbrkn_v4,
  6#inet#filter#bbrkn_v6) into 90-nftset.conf instead of ipset= into
  91-ipset-bbrkn.conf
- DNS_SERVER default 8.8.8.8 -> 127.0.0.1#5350 (host dnsmasq pihole
  delegates bbrkn domains to for VPN resolution + nftset capture)

deploy-to-gateway.sh: two targets, two instances
- 90-nftset.conf -> host /etc/dnsmasq.d (:5350), 92-resolve -> pihole
- full restart of both (dnsmasq SIGHUP does NOT re-read nftset=/server=)
- flush nft sets bbrkn_v4/bbrkn_v6 instead of `ipset flush bbrkn`
- add end-to-end nftset-capture health check via :5350
- rollback restores both files and restarts both instances

Makefile/workflow: rename IPSET_CONF->NFTSET_CONF, add NFTSET_TARGET_DIR
and HOST_DNSMASQ_SVC, DNS_SERVER=127.0.0.1#5350 (escaped `\#` in Make,
quoted in YAML), note runner is ephemeral (cold gekata crawl).

Docs: README + new CLAUDE.md describe the two-dnsmasq / nft-set model;
exit-node DPI failover (10.77.1.2/10.77.2.2) documented as external
(wg-ha.service), not owned by bbrkn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/deploy.yaml

@@ -15,21 +15,28 @@ jobs:
       DOMAINS_FILE: domains.txt
 
       # Временные конфиги (куда пишутся generate-configs.sh)
-      IPSET_CONF: /tmp/91-ipset-bbrkn.conf
+      NFTSET_CONF: /tmp/90-nftset.conf
       RESOLVE_CONF: /tmp/92-resolve-bbrkn.conf
 
-      # DNS-сервер для резолвинга
-      DNS_SERVER: 8.8.8.8
+      # Резолвер, которому pihole делегирует bbrkn-домены (host dnsmasq :5350).
+      # Кавычки обязательны — '#' иначе может трактоваться как комментарий.
+      DNS_SERVER: "127.0.0.1#5350"
 
       # Gekata
       CHROME_SERVER: http://10.77.1.2:3000
 
-      # Директория конфигов на шлюзе
+      # nftset-таргет: host-инстанс dnsmasq (:5350) грузит /etc/dnsmasq.d
+      NFTSET_TARGET_DIR: /etc/dnsmasq.d
+
+      # resolve-таргет: pihole (docker) делегирует bbrkn-домены на :5350
       TARGET_DIR: /opt/appdata/pihole/etc/dnsmasq.d
 
       # Имя контейнера Pi-hole
       DOCKER_CONTAINER: pihole
 
+      # systemd-сервис host-инстанса dnsmasq
+      HOST_DNSMASQ_SVC: dnsmasq
+
       IGNORE_PARTS: "doubleclick yandex mail.ru bigsv.ru mts.ru rambler.ru yadro.ru aif.ru vkvideo.ru tns-counter.ru st.vk.com vk.com"
 
       # Кэш API-ответов (self-hosted runner сохраняет workspace между запусками)
@@ -51,6 +58,6 @@ jobs:
         with:
           name: dnsmasq-configs
           path: |
-            ${{ env.IPSET_CONF }}
+            ${{ env.NFTSET_CONF }}
             ${{ env.RESOLVE_CONF }}
             ${{ env.DEBUG_LOG }}