docs(infra-setup): print required DNS records + public-name override warning

Deployment needs two DNS records this script doesn't manage: a split-horizon
newsfeed.internal -> oolon (the mesh access path), and NO internal override for
the public rob.fyi (an internal record pointing it elsewhere makes mesh clients
land on the wrong vhost/cert — which is exactly what happened: rob.fyi resolved
internally to the office proxy 10.6.0.46 and served admin.zap.pics).

Surface both at the end of every run so the gap is visible.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP

script/infra-setup.sh

@@ -263,11 +263,27 @@ mint_internal_cert() {
     run_remote "$host" "systemctl enable --now step@${CERT_NAME}.timer"
 }
 
+# DNS is not managed by this script, but the deployment doesn't work without two records.
+# Print them explicitly — a missing or wrong split-horizon record is the classic reason a
+# mesh client gets the wrong site/cert (reverse-proxies.md §2, external-tls.md §5).
+dns_reminders() {
+    local web_ip; web_ip="$(getent hosts "$WEB_HOST" | awk '{print $1}' | head -1)"
+    web_ip="${web_ip:-<oolon mesh IP>}"
+    info "DNS (manage separately — not done by this script):"
+    info "  • add split-horizon  ${CERT_NAME}.internal -> ${web_ip}  (mesh access path)"
+    if [[ -n "$PUBLIC_FQDN" ]]; then
+        info "  • ${PUBLIC_FQDN}: public A -> kosherinata WAN only. Do NOT add an internal"
+        info "    override for it — an internal record pointing elsewhere (e.g. the office"
+        info "    proxy) makes mesh clients hit the wrong vhost. Mesh users use ${CERT_NAME}.internal."
+    fi
+}
+
 main() {
     require_files
     info "newsfeed infra-setup (api=$API_HOST web=$WEB_HOST)$([[ $DRY_RUN == 1 ]] && echo ' [dry-run]')"
     provision_api_host
     provision_web_host
+    dns_reminders
     info "done"
 }