feat(netinfra): rebuild netinfra-02 as redundant DNS/DHCP + harden Pi-hole

netinfra-02 was accidentally wiped during storage moves. Rebuilt from
netinfra-01 config: Docker + Technitium (167 zones, rsync timer every 60s),
Pi-hole v6 (healthy, gravity.db validated), NTP container, ISC DHCP failover
secondary (load-balancing with primary, 99+84 active leases).

Pi-hole hardened on BOTH nodes with defense-in-depth against the
gravity.db corruption outage:
- gravity-validate.sh: pre-start SQLite header check, auto-removes corrupt DB
- Healthcheck: validates DNS resolution + gravity.db file integrity
- autoheal container: restarts unhealthy containers automatically
- Root cause (/dev/shm too small) already fixed by operator (shm_size: 1024M)

Also corrected DHCP lease count in audit (98 unique active, not 753 raw blocks).

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

proxmox/docs/AUDIT-2026-08-05.md

@@ -17,7 +17,7 @@ module/subproject layout. Headline deltas:
 |--------|-----------|-----------|---|
 | VMs (running) | 28 | **63** | +125% |
 | DNS zones | 124 | **167** | +35% |
-| DHCP leases | 333 | **753** | +126% |
+| DHCP active leases | 333 | **98** (unique active) | 431 total active binding-state entries |
 | Proxmox hosts | 7 | 7 | — |
 | PVE version (fleet) | mixed (9.1.5–9.2.5) | **all 9.2.5** | tsys4 upgraded |
 | Tailscale nodes | ~30 | **80** | full 3-tier env mirror |