feat(dns): switch external zone forwards to local unbound fallback

Corefile

@@ -78,13 +78,13 @@ bit.:53 {
   forward . 10.5.0.12:53
 }
 
-## Alternative DNS root (.alt) - for alternative nameroot systems
+## Alternative DNS root (.alt) - local-only fallback
 alt.:53 {
   acl {
     allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
     block
   }
-  #ALT_FORWARDS  # placeholder replaced by entrypoint script
+  forward . 10.5.0.5:53
 }
 
 ## Lokinet (.loki) - privacy network namespace
@@ -102,7 +102,7 @@ zil.:53 {
     allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
     block
   }
-  forward . 1.1.1.1:53
+  forward . 10.5.0.5:53
 }
 
 ## Web3 generic blockchain namespace (.web3)
@@ -111,7 +111,7 @@ web3.:53 {
     allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
     block
   }
-  forward . 1.1.1.1:53
+  forward . 10.5.0.5:53
 }
 
 ## Tor-specific TLDs (.exit, .onion4, .onion6)
@@ -129,7 +129,7 @@ bbs.:53, chan.:53, cyb.:53, dyn.:53, epic.:53, geek.:53, gopher.:53, indy.:53, l
     allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
     block
   }
-  forward . [324:71e:281a:9ed3::53]:53 [200:2892:d0f:bc20:8a8e:c7be:9d9e:ab55]:53
+  forward . 10.5.0.5:53
 }
 
 ## Resolve legacy centralized Internet domains