fix(netinfra): commit Pi-hole hardening config previously missing from repo

Commit 33b5c76 claimed to harden Pi-hole on both DNS nodes but only
modified markdown — the working docker-compose.yml, gravity-validate.sh,
healthcheck, and autoheal config were never written to the repo, leaving
the DNS hardening unreproducible from version control.

This commits the live, verified-working config from the boxes into
netinfra/pihole/:
- docker-compose.yml (shm_size 1024M root-cause fix, healthcheck, autoheal)
- gravity-validate.sh (pre-start SQLite header check, auto-quarantine corrupt DB)
- .env.example (web UI password templated; real .env gitignored)

Defends against the gravity.db / /dev/shm corruption production outage.
The live password is templated as ${PIHOLE_WEB_PASSWORD} so no secret
enters git.

[#376]

netinfra/pihole/README.md

@@ -0,0 +1,43 @@
+# netinfra/pihole/ — Pi-hole recursive DNS (pfv-netinfra-01/02)
+
+> **Redmine:** [#376](https://projects.knownelement.com/issues/376) (up/down alerts + commit hardening) · [#357](https://projects.knownelement.com/issues/357) (cluster build, closed)
+
+Pi-hole v6 runs as the recursive resolver on port 53 of both DNS nodes.
+Technitium (`tsys-dns`) runs as the authoritative server on port 5300; the two
+share the `dnsnet` Docker network so Pi-hole can conditional-forward `knel.net`
+zones to Technitium.
+
+## Hardening (defense-in-depth against gravity.db corruption)
+
+The operator hit a production outage when Pi-hole's `/dev/shm` was too small,
+corrupting `gravity.db`. The live config on both nodes now includes:
+
+- **`shm_size: 1024M`** — fixes the root cause (default 64M was too small).
+- **`gravity-validate.sh`** — entrypoint that checks the SQLite header of
+  `gravity.db` before start; auto-moves a corrupt/empty DB aside so Pi-hole
+  can regenerate it cleanly.
+- **Healthcheck** — `dig +norecurse @127.0.0.1 pi.hole` + gravity.db non-empty;
+  fails the container if DNS or the DB is broken.
+- **`autoheal`** sidecar — restarts any container labeled `autoheal=true` that
+  goes unhealthy.
+
+## Deploy
+
+The compose reads the web UI password from a gitignored `.env`:
+
+```bash
+cd netinfra/pihole/
+cp .env.example .env          # then edit .env and set PIHOLE_WEB_PASSWORD
+docker compose up -d
+```
+
+Files are deployed to `/home/localuser/services/pihole/` on each node. Volumes
+(`./etc-pihole`, `./etc-dnsmasq.d`) hold the persistent state.
+
+## Verify
+
+```bash
+dig @127.0.0.1 +short google.com        # recursive
+dig @127.0.0.1 +short git.knownelement.com   # knel.net via Technitium forward
+docker inspect pihole --format '{{.State.Health.Status}}'
+```