adguard: document new *.nuclide.lan zone (30 A-records)

Per-host + per-service LAN-only aliases added 2026-05-24 on CT 102.
Stable names → host IPs; clients use names instead of bare IPs so
service moves only require an AdGuard edit, not N app updates.

Use case driver: Immich Android HTTP/2 Keep-Alive bug — per-SSID
'nuclide' local URL https://immich.nuclide.lan:12000 bypasses Zoraxy.

services/adguard-dns.md

@@ -93,6 +93,23 @@ done
 echo "✅ Done! Add these in AdGuard UI manually."
 ```
 
+## `*.nuclide.lan` zone (LAN-only aliases, added 2026-05-24)
+
+30 A-records mapping stable names to host IPs. Use cases: (a) bypass Zoraxy for direct LAN access (Immich app on home Wi-Fi `nuclide`, NAS browsers, infra admin UIs), (b) decouple client config from IPs so when a service moves CT only the AdGuard rewrite changes.
+
+Naming convention:
+- **Per-host** (one per CT/VM/device): `unifi`, `dlink`, `pve`, `adguard`, `backrest`, `zoraxy`, `id`, `db`, `secrets`, `ops`, `nas`, `docker`, `nextcloud`, `dev`, `shepard`, `ha`, `mainsail`
+- **Per-service** (alias when only port differs from the host): `immich`, `vault`, `karakeep`, `memos`, `abs`, `gotify`, `n8n`, `chat`, `ai`, `mcp`, `grafana`, `prometheus`, `homarr`
+
+Full list in `/opt/AdGuardHome/AdGuardHome.yaml` under `dns.rewrites:`. Auto-pushed nightly to [`fkrebs/adguard-conf`](https://git.nuclide.systems/fkrebs/adguard-conf).
+
+**Adding a new service alias:**
+1. Append a `- {domain: <new>.nuclide.lan, answer: 192.168.x.y, enabled: true}` line
+2. `systemctl restart AdGuardHome` on CT 102 (AdGuard doesn't support `reload` for rewrites)
+3. Verify: `dig +short @192.168.1.2 <new>.nuclide.lan`
+
+**When a service moves CT (changes IP):** edit only the AdGuard rewrite → restart. No client app needs an update — this is the whole point of the alias zone.
+
 ## Alternative Useful DNS Entries
 
 ### NextCloud & Sync