Make AdGuard settings authoritative; add busybox; drop fallback DNS

- services/adguard.nix: mutableSettings = false so Nix config overrides
  UI-made changes on rebuild (settings are the source of truth)
- common.nix: add busybox for its collection of handy utilities
- common.nix: remove networking.nameservers — DNS now comes purely from
  per-host NetworkManager config (AdGuard as the only resolver, no leaks)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

common.nix

@@ -67,7 +67,6 @@
 
   # Enable network-manager
   networking.networkmanager.enable = true;
-  networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
   # Fish shell
   programs.fish.enable = true;
@@ -87,5 +86,6 @@
       git
       localsend
       nvd
+      busybox
   ];
 }