fix(netinfra): commit Pi-hole hardening config previously missing from repo

Commit 33b5c76 claimed to harden Pi-hole on both DNS nodes but only
modified markdown — the working docker-compose.yml, gravity-validate.sh,
healthcheck, and autoheal config were never written to the repo, leaving
the DNS hardening unreproducible from version control.

This commits the live, verified-working config from the boxes into
netinfra/pihole/:
- docker-compose.yml (shm_size 1024M root-cause fix, healthcheck, autoheal)
- gravity-validate.sh (pre-start SQLite header check, auto-quarantine corrupt DB)
- .env.example (web UI password templated; real .env gitignored)

Defends against the gravity.db / /dev/shm corruption production outage.
The live password is templated as ${PIHOLE_WEB_PASSWORD} so no secret
enters git.

[#376]

STATUS.md

@@ -7,7 +7,7 @@
 > checklists or status items here. All work is tracked as Redmine tickets.
 > When work is done, update the ticket (done ratio, notes, close).
 
-> **Last updated:** 2026-08-06 — migrated all tracking to Redmine.
+> **Last updated:** 2026-08-06 — Pi-hole hardening config committed (`netinfra/pihole/`, [#376]).
 
 ## Current State: MIXED (infra stable; k8s needs rebuild)
 
@@ -35,6 +35,7 @@ are operational. **k8s control plane is DOWN** (cnode wiped, no etcd quorum).
 
 | Ticket | Component | Notes |
 |--------|-----------|-------|
+| [#376](https://projects.knownelement.com/issues/376) | DNS cluster up/down alerts + Pi-hole hardening committed | Config now in `netinfra/pihole/`; flapping source under investigation |
 | [#367](https://projects.knownelement.com/issues/367) | k8s cluster rebuild (cnode wiped, no quorum) | Blocks #368 |
 | [#368](https://projects.knownelement.com/issues/368) | k8s worker nodes join cluster | Blocked by #367 |
 | [#369](https://projects.knownelement.com/issues/369) | Switch config fixes (core-sw01 LAG, LACP, member list) | Onsite Friday |