coredns: fix ENOTFOUND for own zone, enable dns64 for IPv4 clients

Two Corefile changes:
- Add lumpiasty.xyz server block without dns64. Replaces the manual
  RouterOS static FWD entry (\"bypass nat64\") which returned NOERROR
  with empty answer instead of relaying NXDOMAIN. Combined with
  ndots:5 and pod search domains this made getaddrinfo stop at the
  search-suffixed candidate and fail with ENOTFOUND for valid names
  (kaneo -> authentik OAuth fetch failures). CoreDNS relays rcodes
  faithfully; internal zone keeps real AAAA for native IPv6.
- Add allow_ipv4 to dns64 (previously uncommitted): without it only
  queries arriving over IPv6 are synthesized, but all clients reach
  CoreDNS via RouterOS over IPv4, so translate_all never applied.
The RouterOS static FWD entry must be removed after deploying the new
image - ansible already declares only the ts.net entry, so a playbook
run handles it.

mikrotik/coredns/Corefile

@@ -1,3 +1,22 @@
+# Our own zone bypasses DNS64: internal services have native IPv6 (LB pool
+# routed via HE prefix), so clients should get real AAAA records and connect
+# directly instead of hairpinning through NAT64.
+#
+# This MUST live here, not as a RouterOS static FWD entry: RouterOS FWD
+# entries return NOERROR with an empty answer instead of relaying NXDOMAIN,
+# which breaks getaddrinfo search-domain processing (resolver stops at the
+# first NODATA search candidate and never tries the absolute name -> apps
+# fail with ENOTFOUND for names that exist).
+lumpiasty.xyz:53 {
+    forward . 1.1.1.1 8.8.8.8 {
+        prefer_udp
+    }
+
+    cache 300
+    errors
+    log
+}
+
 .:53 {
     # Synthesize AAAA from A records for all destinations.
     # translate_all: override real AAAA records too, so all traffic exits