fix(dns): retire tailscale-router references; netinfra pair is prod [#728]

Founder ruling 2026-09-02: tailscale-router retired, subnet routing now
pfv-netinfra-01/02 (both advertise 192.168.0.0/22 + exit routes, verified).
Drop dead tsrouter alias from the chokepoint script; setup/verify now use
the primary as production source; refresh verify record list (tsys-nsm is
also a dead name; add tsys-wazuh CNAME + tsys-siem).

archive/KNELServerBuild copies left as read-only history by design.

netinfra/dns-cluster-setup/setup.sh

@@ -2,12 +2,16 @@
 #
 # setup.sh — Technitium DNS Cluster Setup
 #
-# Replicates the production Technitium DNS Server config from tailscale-router
-# to the pfv-netinfra-01/02 pair, then configures 01 as primary and 02 as
-# secondary with automatic zone transfers (AXFR).
+# BOOTSTRAP (historical): originally exported the production config from the
+# retired tailscale-router host to the pfv-netinfra-01/02 pair. Since
+# 2026-09-02 (router retired) the export source is pfv-netinfra-01 itself,
+# the live primary and SoR for knel.net zones.
 #
-# PRODUCTION SAFETY: tailscale-router is accessed READ-ONLY. No file on it is
-# modified. The only operation is a docker cp (read) to export the config.
+# Configures 01 as primary and 02 as secondary with automatic zone
+# transfers (AXFR).
+#
+# PRODUCTION SAFETY: the export source is accessed READ-ONLY. No file on it
+# is modified. The only operation is a docker cp (read) to export the config.
 #
 # ARCHITECTURE AFTER SETUP:
 #
@@ -19,8 +23,6 @@
 #     Pi-hole (:53) → Technitium (:5300 inside container)
 #     All zones are Secondary; AXFR from 01 on changes
 #
-#   tailscale-router — PRODUCTION (untouched, read-only source of truth)
-#
 # CLUSTERING MECHANISM:
 #   Technitium primary/secondary via DNS zone transfers (AXFR/IXFR + NOTIFY).
 #   01 serves all zones as Primary. 02 fetches them as Secondary from
@@ -33,7 +35,7 @@
 #   all three servers.
 #
 # USAGE:
-#   ./setup.sh export     # Step 1: read-only export from tailscale-router
+#   ./setup.sh export     # Step 1: read-only export from primary (netinfra-01)
 #   ./setup.sh deploy01   # Step 2: deploy config to netinfra-01 (primary)
 #   ./setup.sh deploy02   # Step 3: deploy config to netinfra-02 (secondary)
 #   ./setup.sh cluster    # Step 4: configure clustering (01 primary, 02 secondary)
@@ -46,7 +48,7 @@ HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REMOTE="$HERE/remote-dns.sh"
 
 # Host aliases (defined in remote-dns.sh)
-PROD="tsrouter"        # tailscale-router (READ-ONLY)
+PROD="$PRIMARY"        # export source: primary (was tailscale-router, retired 2026-09-02)
 PRIMARY="netinfra01"   # pfv-netinfra-01
 SECONDARY="netinfra02" # pfv-netinfra-02