router: phase-2 cleanup + camera DHCP reservation

- trustedLegacyCidrs now empty; eno1 is strictly WAN
- AdGuard rewrite retargets nordhammer.it → 10.0.0.1 (the new router IP)
- dnsmasq pins the bedroom camera (f0:a7:31:6c:50:4b) to 10.0.0.39

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

services/adguard.nix

@@ -35,11 +35,11 @@
           { enabled = true; id = 3; name = "OISD Big";
             url = "https://big.oisd.nl/"; }
         ];
-        # Resolve our own hostnames to the mediaserver's LAN IP so LAN
-        # clients bypass eero hairpin NAT. Update to 10.0.0.1 in phase 2.
+        # Resolve our own hostnames to the router's LAN IP so LAN clients
+        # bypass any NAT reflection.
         filtering.rewrites = [
-          { domain = "nordhammer.it";   answer = "192.168.4.25"; }
-          { domain = "*.nordhammer.it"; answer = "192.168.4.25"; }
+          { domain = "nordhammer.it";   answer = "10.0.0.1"; }
+          { domain = "*.nordhammer.it"; answer = "10.0.0.1"; }
         ];
       };
     };