feat: advertise the office indirection name for P2P

/dns4/ rather than the literal WAN address so an IP change needs no
redeploy, matching the per-site indirection convention in public-dns.md.

Paired with a 'bob' host alias on the site router (10.6.0.193, created
via opn-cli to match the existing hanzalova/oci/quadbrat convention).
The inbound 30333/tcp forward that makes both meaningful is still
outstanding and has to be a console change: opn-cli exposes firewall
alias and rule but no NAT subcommand.

.gitea/workflows/deploy.yaml

@@ -127,7 +127,11 @@ jobs:
             # Complete flag, or "" for a node with no public ingress. Requires a
             # matching inbound TCP forward at the site edge — the flag only
             # advertises, it does not open anything.
-            public_addr: ""
+            #
+            # /dns4/ rather than a literal address: the site's WAN IP can change
+            # without a redeploy, and this is the per-site indirection name the
+            # fleet already uses (architecture public-dns.md).
+            public_addr: "--public-addr /dns4/nh.thgttg.com/tcp/30333"
           # Second site, for decentralisation. Uncomment when provisioned, and
           # give it its OWN inner_hash derived from its OWN wallet — sharing
           # bob's would publicly tie the two sites to one operator and defeat