Add DNS filtering with dnsmasq address=/ directives for wildcard blocking

Adds Pi-hole-style DNS filtering using dnsmasq's native address=/ directives,
which block domains and all subdomains. Users subscribe to blocklists by URL
or upload files, with suggested lists from Hagezi, Steven Black, and OISD.
Background runner refreshes lists on a configurable interval (default 24h).

internal/dnsmasq/config_test.go

@@ -313,6 +313,43 @@ func TestGenerate_MultipleEntries(t *testing.T) {
 	}
 }
 
+func TestGenerate_ConfFile(t *testing.T) {
+	g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
+	g.SetFilterConfPath("/var/lib/wild-central/dns-filter/hosts.blocked")
+
+	out := g.Generate(nil, nil)
+
+	if !strings.Contains(out, "conf-file=/var/lib/wild-central/dns-filter/hosts.blocked") {
+		t.Errorf("expected addn-hosts directive, got:\n%s", out)
+	}
+	if !strings.Contains(out, "# DNS Filtering") {
+		t.Errorf("expected DNS Filtering comment, got:\n%s", out)
+	}
+}
+
+func TestGenerate_NoConfFileWhenEmpty(t *testing.T) {
+	g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
+	// addnHostsPath is empty by default
+
+	out := g.Generate(nil, nil)
+
+	if strings.Contains(out, "addn-hosts") {
+		t.Errorf("should not contain addn-hosts when path is empty, got:\n%s", out)
+	}
+}
+
+func TestGenerateMainConfig_ConfFile(t *testing.T) {
+	g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
+	g.SetFilterConfPath("/tmp/hosts.blocked")
+
+	cfg := &config.State{}
+	out := g.GenerateMainConfig(cfg)
+
+	if !strings.Contains(out, "conf-file=/tmp/hosts.blocked") {
+		t.Errorf("expected addn-hosts in main config, got:\n%s", out)
+	}
+}
+
 // Test: nil config doesn't panic, uses auto-detect for IP
 func TestGenerate_NilConfig(t *testing.T) {
 	g := NewConfigGenerator("/tmp/test-dnsmasq.conf")