nixserve: stop Tailscale from hijacking DNS resolution

Tailscale's stub resolver (100.100.100.100) intermittently times out
or SERVFAILs under bursty concurrent lookups (a known upstream issue,
e.g. tailscale/tailscale#6850, #10768, #8829), which was breaking HACS
updates in the Home Assistant container (network_mode: host, so it
inherits nixserve's own resolv.conf). Point nixserve at the local
Pi-hole instead and disable Tailscale's accept-dns so it can't
override it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/nixserve/default.nix

@@ -9,6 +9,11 @@
   networking.hostName = "nixserve";
   networking.hostId = "941b956b";
   networking.networkmanager.enable = true;
+  # nixserve's own DNS lookups (e.g. HACS/docker pulls) go to the local Pi-hole
+  # first instead of detouring through Tailscale's DNS proxy -> home router,
+  # which was timing out under HACS's bursty concurrent lookups. Tailscale's
+  # MagicDNS resolver (100.100.100.100) stays as a fallback nameserver.
+  networking.nameservers = [ "127.0.0.1" ];
 
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.forceImportRoot = false;