feat(infra): dnsweaver manages AdGuard rewrites for labeled containers

Managed mode (type+target-scoped orphan cleanup). Wildcard *.arnoutvw.nl
rewrite removed; defaultRule-derived (unlabeled) hostnames kept as static
rewrites via EXCLUDE_DOMAINS.

infra/compose.yaml

@@ -1,4 +1,37 @@
 services:
+  dnsweaver:
+    # Auto-manages AdGuard (192.168.10.54:3000, primary of the 2 synced
+    # instances) DNS rewrites for containers carrying traefik router rule
+    # labels, plus the traefik file-provider rules (fileConfig.yml mount).
+    # Managed mode: orphan cleanup deletes only records whose type+target
+    # match (A -> 192.168.10.144), which is why the *.arnoutvw.nl wildcard
+    # rewrite was removed and every defaultRule-derived hostname (no router
+    # label on its container) lives as an EXCLUDE_DOMAINS static rewrite.
+    image: maxamill/dnsweaver:latest
+    container_name: dnsweaver
+    restart: unless-stopped
+    init: true
+    network_mode: bridge
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /mnt/user/appdata/traefik/fileConfig.yml:/etc/traefik/fileConfig.yml:ro
+    environment:
+      TZ: Europe/Amsterdam
+      DNSWEAVER_LOG_LEVEL: info
+      DNSWEAVER_SOURCES: traefik
+      DNSWEAVER_SOURCE_TRAEFIK_FILE_PATHS: /etc/traefik/fileConfig.yml
+      DNSWEAVER_INSTANCES: adguard
+      DNSWEAVER_ADGUARD_TYPE: adguard
+      DNSWEAVER_ADGUARD_URL: http://192.168.10.54:3000
+      DNSWEAVER_ADGUARD_USERNAME: arnout
+      DNSWEAVER_ADGUARD_PASSWORD: ${DNSWEAVER_ADGUARD_PASSWORD}
+      DNSWEAVER_ADGUARD_MODE: managed
+      DNSWEAVER_ADGUARD_RECORD_TYPE: A
+      DNSWEAVER_ADGUARD_TARGET: 192.168.10.144
+      DNSWEAVER_ADGUARD_ZONE: arnoutvw.nl
+      DNSWEAVER_ADGUARD_DOMAINS: "*.arnoutvw.nl"
+      DNSWEAVER_ADGUARD_EXCLUDE_DOMAINS: adguard-exporter.arnoutvw.nl,bazarr.arnoutvw.nl,binhex-jackett.arnoutvw.nl,binhex-krusader.arnoutvw.nl,bookorbit-db.arnoutvw.nl,cadvisor.arnoutvw.nl,chrome.arnoutvw.nl,cloudcommander.arnoutvw.nl,dawarich_db.arnoutvw.nl,dawarich_redis.arnoutvw.nl,dawarich_sidekiq.arnoutvw.nl,dockersocket.arnoutvw.nl,duplicati.arnoutvw.nl,fileflows.arnoutvw.nl,gitea.arnoutvw.nl,grafana.arnoutvw.nl,homepage.arnoutvw.nl,hydra2.arnoutvw.nl,immich_machine_learning.arnoutvw.nl,immich_postgres.arnoutvw.nl,influxdb-1.8.arnoutvw.nl,kavita.arnoutvw.nl,komodo-mongo.arnoutvw.nl,komodo-periphery.arnoutvw.nl,maintainerr.arnoutvw.nl,mariadb.arnoutvw.nl,mealie.arnoutvw.nl,n8n.arnoutvw.nl,netbootxyz.arnoutvw.nl,newt-secondary.arnoutvw.nl,newt.arnoutvw.nl,ntfy.arnoutvw.nl,paperless-ng.arnoutvw.nl,paperless-ngx-kristin.arnoutvw.nl,pgadmin4.arnoutvw.nl,phpmyadmin.arnoutvw.nl,postgres14.arnoutvw.nl,postgres_exporter.arnoutvw.nl,postgresql17.arnoutvw.nl,qdirstat.arnoutvw.nl,redis.arnoutvw.nl,scraparr.arnoutvw.nl,stash.arnoutvw.nl,stirlingpdf.arnoutvw.nl,wallos.arnoutvw.nl,wordpress-blues.arnoutvw.nl
+
   smartctl-exporter:
     image: quay.io/prometheuscommunity/smartctl-exporter:v0.14.0
     container_name: smartctl-exporter