add ad blocking, live dashboard, system DNS auto-discovery

- DNS-level ad blocking: 385K+ domains via Hagezi Pro blocklist, subdomain
  matching, one-click allowlist, pause/toggle, background refresh every 24h
- Live dashboard at :5380 with real-time stats, query log, override
  management (create/edit/delete), blocking controls
- System DNS auto-discovery: parses scutil --dns on macOS to find
  conditional forwarding rules (Tailscale, VPN split-DNS)
- REST API expanded to 18 endpoints (blocking, overrides, diagnostics)
- Startup banner with colored system info
- Performance benchmarks (bench/dns-bench.sh)
- Landing page updated with new positioning and comparison table
- CI, Dockerfile, LICENSE, development plan docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

numa.toml

@@ -0,0 +1,26 @@
+[server]
+bind_addr = "0.0.0.0:53"
+api_port = 5380
+
+[upstream]
+address = "8.8.8.8"
+port = 53
+timeout_ms = 3000
+
+[cache]
+max_entries = 10000
+min_ttl = 60
+max_ttl = 86400
+
+# Example zone records:
+# [[zones]]
+# domain = "dimescu.ro"
+# record_type = "A"
+# value = "3.120.139.105"
+# ttl = 30
+
+# [[zones]]
+# domain = "test.local"
+# record_type = "A"
+# value = "127.0.0.1"
+# ttl = 60