TP23 Stufe 2 + TP31 Schritt 4: AdGuard split-horizon mit .bf.-Suffix, Caddyfile .bf.-FQDNs

- AGH 110/111: conditional upstream [/bf.emsenhuber.net/]10.40.20.1
- 47 Rewrites: 16 Service->Caddy (inkl. .bf.), 10 Hosts mit .bf., suffixlose parallel
- Caddyfile: interne Sites mit .bf.-Alias (public vw/hass/n8n/gitea ohne)
- DHCP: alle 7 VLANs zeigen auf .36/.37 (domain=emsenhuber.net)
- Firewall-Regeln auf .36/.37 bereits scharf
- nas.emsenhuber.net endgueltig entfernt (war schon in 1d569fa)
- Ist-Stand-Block + Status-Tabelle nachgezogen

caddy/Caddyfile

@@ -39,7 +39,7 @@ gitea.emsenhuber.net {
 # =========================================================================
 # INTERN  (Mesh/LAN; Split-Horizon zeigt diese Namen auf 10.40.20.40)
 # =========================================================================
-nautobot.emsenhuber.net {
+nautobot.emsenhuber.net, nautobot.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.30:8080
 }
 
@@ -51,49 +51,49 @@ ds-bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.10:8080
 }
 
-ccu.emsenhuber.net {
+ccu.emsenhuber.net, ccu.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.232
 }
 
-iobroker.emsenhuber.net {
+iobroker.emsenhuber.net, iobroker.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.107:8081
 }
 
-z2m25.emsenhuber.net {
+z2m25.emsenhuber.net, z2m25.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.106:8080
 }
 
 # --- MCP-Endpunkte: heute spricht ~/.claude.json diese IPs roh --------------
-pve-mcp.emsenhuber.net {
+pve-mcp.emsenhuber.net, pve-mcp.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.173:3000
 }
 
-ha-mcp.emsenhuber.net {
+ha-mcp.emsenhuber.net, ha-mcp.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.105:9583
 }
 
-n8n-mcp.emsenhuber.net {
+n8n-mcp.emsenhuber.net, n8n-mcp.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.167:3001
 }
 
-gitea-mcp.emsenhuber.net {
+gitea-mcp.emsenhuber.net, gitea-mcp.bf.emsenhuber.net {
 	reverse_proxy http://10.40.20.167:3000
 }
 
 # --- HTTPS-Backends (Selbstsignat) -----------------------------------------
-pve.emsenhuber.net {
+pve.emsenhuber.net, pve.bf.emsenhuber.net {
 	reverse_proxy https://10.40.20.100:8006 {
 		import selfsigned
 	}
 }
 
-portainer.emsenhuber.net {
+portainer.emsenhuber.net, portainer.bf.emsenhuber.net {
 	reverse_proxy https://10.40.20.126:9443 {
 		import selfsigned
 	}
 }
 
-pbs.emsenhuber.net {
+pbs.emsenhuber.net, pbs.bf.emsenhuber.net {
 	reverse_proxy https://10.40.20.135:8007 {
 		import selfsigned
 	}