nixserve: stop Tailscale from hijacking DNS resolution

Tailscale's stub resolver (100.100.100.100) intermittently times out
or SERVFAILs under bursty concurrent lookups (a known upstream issue,
e.g. tailscale/tailscale#6850, #10768, #8829), which was breaking HACS
updates in the Home Assistant container (network_mode: host, so it
inherits nixserve's own resolv.conf). Point nixserve at the local
Pi-hole instead and disable Tailscale's accept-dns so it can't
override it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/nixserve/services.nix

@@ -67,6 +67,12 @@ in
     enable = true;
     openFirewall = true;
     useRoutingFeatures = "server";
+    # Don't let Tailscale take over nixserve's own DNS resolution: its stub
+    # resolver (100.100.100.100) intermittently times out under bursty lookups
+    # (a known upstream issue, e.g. tailscale/tailscale#6850, #10768, #8829),
+    # which broke HACS updates. nixserve resolves via local Pi-hole instead
+    # (see networking.nameservers in hosts/nixserve/default.nix).
+    extraSetFlags = [ "--accept-dns=false" ];
   };
 
   services.syncthing = {