Add DNS filtering with dnsmasq address=/ directives for wildcard blocking

Adds Pi-hole-style DNS filtering using dnsmasq's native address=/ directives,
which block domains and all subdomains. Users subscribe to blocklists by URL
or upload files, with suggested lists from Hagezi, Steven Black, and OISD.
Background runner refreshes lists on a configurable interval (default 24h).

main.go

@@ -123,6 +123,7 @@ func main() {
 	slog.Info("central status broadcaster started")
 
 	api.StartDDNS(ctx)
+	api.StartDNSFilter(ctx)
 
 	router := mux.NewRouter()
 	api.RegisterRoutes(router)