router: expose forwarded ports on eno1; AdGuard rewrite for LAN hostname

- Input chain now accepts WAN traffic for every port in ports.toml so
  external access (SSH, HTTP, HTTPS, game ports) works through the eero's
  upstream port forwards during phase 1, and via our own DNAT in phase 2.
- Add AdGuard DNS rewrite nordhammer.it → 192.168.4.25 so LAN clients
  hit the mediaserver directly instead of relying on eero hairpin NAT.
  Target changes to 10.0.0.1 at phase 2 cutover.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

services/adguard.nix

@@ -35,6 +35,12 @@
           { enabled = true; id = 3; name = "OISD Big";
             url = "https://big.oisd.nl/"; }
         ];
+        # Resolve our own hostnames to the mediaserver's LAN IP so LAN
+        # clients bypass eero hairpin NAT. Update to 10.0.0.1 in phase 2.
+        filtering.rewrites = [
+          { domain = "nordhammer.it";   answer = "192.168.4.25"; }
+          { domain = "*.nordhammer.it"; answer = "192.168.4.25"; }
+        ];
       };
     };