Migrate bbrkn from legacy ipset to nftables sets

The gateway (Archie) routes bbrkn domains via nft sets bbrkn_v4/bbrkn_v6
(inet filter), not the legacy ipset. bbrkn was still emitting dead
`ipset=/domain/bbrkn` directives (no such ipset exists) plus a 92-resolve
pointing at 8.8.8.8, both overridden by hand-maintained files on the host.
This makes bbrkn the generator of record for the real scheme.

generate-configs.sh:
- emit `nftset=/domain/$NFTSET_SPEC` (default 4#inet#filter#bbrkn_v4,
  6#inet#filter#bbrkn_v6) into 90-nftset.conf instead of ipset= into
  91-ipset-bbrkn.conf
- DNS_SERVER default 8.8.8.8 -> 127.0.0.1#5350 (host dnsmasq pihole
  delegates bbrkn domains to for VPN resolution + nftset capture)

deploy-to-gateway.sh: two targets, two instances
- 90-nftset.conf -> host /etc/dnsmasq.d (:5350), 92-resolve -> pihole
- full restart of both (dnsmasq SIGHUP does NOT re-read nftset=/server=)
- flush nft sets bbrkn_v4/bbrkn_v6 instead of `ipset flush bbrkn`
- add end-to-end nftset-capture health check via :5350
- rollback restores both files and restarts both instances

Makefile/workflow: rename IPSET_CONF->NFTSET_CONF, add NFTSET_TARGET_DIR
and HOST_DNSMASQ_SVC, DNS_SERVER=127.0.0.1#5350 (escaped `\#` in Make,
quoted in YAML), note runner is ephemeral (cold gekata crawl).

Docs: README + new CLAUDE.md describe the two-dnsmasq / nft-set model;
exit-node DPI failover (10.77.1.2/10.77.2.2) documented as external
(wg-ha.service), not owned by bbrkn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/generate-configs.sh

@@ -6,11 +6,17 @@ set -euo pipefail
 # ==============================
 INPUT_FILE="${DOMAINS_FILE:-domains.txt}"
 
-IPSET_CONF="${IPSET_CONF:-/tmp/91-ipset-bbrkn.conf}"
+NFTSET_CONF="${NFTSET_CONF:-/tmp/90-nftset.conf}"
 RESOLVE_CONF="${RESOLVE_CONF:-/tmp/92-resolve-bbrkn.conf}"
 
+# nftset-цель для dnsmasq: <4|6>#<family>#<table>#<set>[,...]
+# 4# → A-записи в bbrkn_v4; 6# → AAAA в bbrkn_v6 (таблица: inet filter)
+NFTSET_SPEC="${NFTSET_SPEC:-4#inet#filter#bbrkn_v4,6#inet#filter#bbrkn_v6}"
+
 API_URL="${CHROME_SERVER:-http://127.0.0.1:3000}/domains?domain="
-DNS_SERVER="${DNS_SERVER:-8.8.8.8}"
+# Куда pihole делегирует резолвинг bbrkn-доменов: инстанс dnsmasq :5350, который
+# резолвит через VPN и наполняет nft-сеты. Формат dnsmasq server=: ip[#port].
+DNS_SERVER="${DNS_SERVER:-127.0.0.1#5350}"
 
 # Игнорируемые части доменов (разделитель — пробел)
 IGNORE_PARTS="${IGNORE_PARTS:-}"
@@ -43,7 +49,7 @@ if ! command -v jq   >/dev/null 2>&1; then err "jq is required";   exit 2; fi
 if [ "$DEBUG" != "0" ]; then : > "$DEBUG_LOG"; dbg "Debugging enabled"; fi
 
 log "Starting generate-configs.sh"
-dbg "ENV: INPUT_FILE=$INPUT_FILE IPSET_CONF=$IPSET_CONF RESOLVE_CONF=$RESOLVE_CONF API_URL=$API_URL DNS_SERVER=$DNS_SERVER IGNORE_PARTS='$IGNORE_PARTS' DRY_RUN=$DRY_RUN CACHE_DIR=$CACHE_DIR CACHE_TTL_DAYS=$CACHE_TTL_DAYS STRICT_MODE=$STRICT_MODE"
+dbg "ENV: INPUT_FILE=$INPUT_FILE NFTSET_CONF=$NFTSET_CONF NFTSET_SPEC=$NFTSET_SPEC RESOLVE_CONF=$RESOLVE_CONF API_URL=$API_URL DNS_SERVER=$DNS_SERVER IGNORE_PARTS='$IGNORE_PARTS' DRY_RUN=$DRY_RUN CACHE_DIR=$CACHE_DIR CACHE_TTL_DAYS=$CACHE_TTL_DAYS STRICT_MODE=$STRICT_MODE"
 
 if [ ! -f "$INPUT_FILE" ]; then
   err "Input file not found: $INPUT_FILE"
@@ -313,9 +319,9 @@ if ! $DRY_RUN; then
   {
     for d in "${ORDERED_DOMS[@]}"; do
       [[ -n "${OUTPUT_COMMENT[$d]:-}" ]] && printf '%s\n' "${OUTPUT_COMMENT[$d]}"
-      printf 'ipset=/%s/bbrkn\n' "$d"
+      printf 'nftset=/%s/%s\n' "$d" "$NFTSET_SPEC"
     done
-  } > "$IPSET_CONF"
+  } > "$NFTSET_CONF"
   {
     for d in "${ORDERED_DOMS[@]}"; do
       [[ -n "${OUTPUT_COMMENT[$d]:-}" ]] && printf '%s\n' "${OUTPUT_COMMENT[$d]}"