feat(pihole): add knoe.dev GKE service records for LAN split-horizon DNS

Adds dnsmasq address= directives for all active knoe.dev GKE endpoints
so LAN clients (morgana, Pi nodes) resolve them without hitting external DNS.

Records added:
  mcp.0.knoe.dev   → 8.232.93.14    (knoe-mcp GCE LB)
  auth.0.knoe.dev  → 34.36.71.141   (knoe-auth GCE LB)
  api.0.knoe.dev   → 34.120.221.5   (supabase-kong GCE LB)
  db.0.knoe.dev    → 34.120.221.5   (supabase-kong GCE LB)
  app.0.knoe.dev   → 34.120.221.5   (supabase-kong GCE LB)

auth.0.knoe.dev was previously resolving to 34.120.221.5 (wrong — supabase LB)
causing the knoe-auth managed cert to be stuck Provisioning for 20 days.
Correct IP is 34.36.71.141. Also update auth.0.knoe.dev in external DNS
(name.com) to unblock the GCP managed cert.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/inventory/group_vars/pihole.yml

@@ -11,3 +11,20 @@ lan_reverse_zone: "0.0.10.in-addr.arpa"
 # Performance/resilience knobs
 pihole_dns_forward_max: 300
 pihole_sqlite_busy_timeout: 5000
+
+# knoe.dev GKE service records — resolved on the LAN via dnsmasq address= directives.
+# These bypass split-horizon Samba DNS which only knows prole.org, not knoe.dev.
+# GCE LB IPs are stable (manually assigned via GCP static IP reservation).
+#
+# To update: change the IP below and re-run the pihole_dns role.
+# Source of truth: `kubectl get ingress -A` on the knoe-dev-0 cluster.
+knoe_dev_dns_records:
+  # knoe-mcp: company knowledge MCP  (GCE LB: knoe-mcp-knoeledge-mcp)
+  - { name: "mcp.0.knoe.dev",    ip: "8.232.93.14"  }
+  # knoe-auth: identity / OIDC / Kerberos token exchange  (GCE LB: knoe-auth)
+  - { name: "auth.0.knoe.dev",   ip: "34.36.71.141"  }
+  # supabase kong: API gateway + DB proxy  (GCE LB: supabase-kong)
+  - { name: "api.0.knoe.dev",    ip: "34.120.221.5"  }
+  - { name: "db.0.knoe.dev",     ip: "34.120.221.5"  }
+  # Knoey web app
+  - { name: "app.0.knoe.dev",    ip: "34.120.221.5"  }

infrastructure/roles/pihole_dns/tasks/main.yml

@@ -23,6 +23,15 @@
     mode: "0644"
   notify: restart pihole-FTL
 
+- name: Configure knoe.dev GKE service records (LAN split-horizon)
+  ansible.builtin.template:
+    src: 06-knoe-dev.conf.j2
+    dest: /etc/dnsmasq.d/06-knoe-dev.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart pihole-FTL
+
 - name: Read current Pi-hole FTL DB journal mode (WAL?)
   ansible.builtin.command: sqlite3 /etc/pihole/pihole-FTL.db "PRAGMA journal_mode;"
   register: pihole_journal

infrastructure/roles/pihole_dns/templates/06-knoe-dev.conf.j2

@@ -0,0 +1,11 @@
+# knoe.dev GKE service records
+# Injected by Ansible pihole_dns role — do not edit manually.
+#
+# GKE app cluster (knoe-dev-0) LB endpoints:
+#   mcp.*       → 8.232.93.14   (knoe-mcp GCE LB)
+#   auth.*      → 34.36.71.141  (knoe-auth GCE LB)
+#   api.*, db.* → 34.120.221.5  (supabase-kong GCE LB)
+
+{% for record in knoe_dev_dns_records %}
+address=/{{ record.name }}/{{ record.ip }}
+{% endfor %}