Add standalone Pi-hole service; move wg-easy's default port off Netbird's

Two independent, requested changes:

- services/pihole.sh: new standalone service, Pi-hole v6 (the image moved
  entirely to a TOML-based /etc/pihole config — the old WEBPASSWORD env var
  and separate /etc/dnsmasq.d volume are both gone; uses
  FTLCONF_webserver_api_password and FTLCONF_dns_listeningMode=ALL
  instead). Deliberately not wired into wg-easy or any other VPN — a device
  has to be pointed at it manually (per-device or via router DHCP). DNS
  itself (53/tcp+udp) is never scanned/moved since shifting it off the
  standard port would defeat the point; a port_in_use check warns instead
  of blocking, since the common case (systemd-resolved on 127.0.0.53 only)
  doesn't actually collide with Pi-hole binding the host's real interfaces.
  Web admin UI is Caddy-fronted like everything else in this repo. Added to
  the README services table.

- services/wg-easy.sh: default VPN/web ports moved from 51820/51821 to
  51830/51831. Netbird's own WireGuard listener also defaults to exactly
  51820 — installing both on one box means wg-easy's existing scan-and-move
  logic would silently shift its port every time, which is harder to
  predict/document than just not starting on the collision in the first
  place. The scan itself is unchanged and still moves both ports further if
  even the new default is taken.

Tested pihole.sh's full standalone install flow (no-Caddy and
Caddy-present-locally cases) against a mocked environment, validating both
generated docker-compose.yml files with `docker compose config`, and
confirmed the reinstall-mode gate correctly no-ops on a second run in
unattended mode.

services/wg-easy.sh

@@ -9,7 +9,17 @@
 # Ported from ubuntu-post-install-24.04-crowdsec.sh (# ---- WG-EASY ----).
 # Own ~/docker/wg-easy/ with a standalone docker-compose.yml + .env.
 # Requires cap_add: NET_ADMIN + SYS_MODULE and ip_forward sysctl.
-# Forward UDP 51820 on your router to this server for external VPN access.
+# Forward UDP 51830 on your router to this server for external VPN access
+# (default — scanned/moved at install time if already taken; see below).
+#
+# Default port deliberately isn't WireGuard's conventional 51820: Netbird's
+# own WireGuard listener also defaults to exactly 51820, and this is the
+# one service in this repo where two completely independent tools (this
+# repo's own wg-easy and a separately-installed Netbird) are both likely to
+# reach for the same hardcoded upstream default with no scanning of their
+# own on Netbird's side. Starting one port family away avoids that
+# collision in the common case; the scan below still moves both further if
+# even the new default is somehow already taken.
 
 # ── Standalone bootstrap ──────────────────────────────────────────────────────
 # Detected when the script is executed directly rather than sourced by setup.sh.
@@ -207,13 +217,13 @@ CBLOCK
 fi
 # ─────────────────────────────────────────────────────────────────────────────
 
-register_service wg-easy utilities "WireGuard VPN with web management UI (wg-easy); peers mesh through this hub automatically, with a script to sync SSH aliases" 51821
+register_service wg-easy utilities "WireGuard VPN with web management UI (wg-easy); peers mesh through this hub automatically, with a script to sync SSH aliases" 51831
 
 install_wg-easy() {
     require_docker || return 1
 
     local WGEASY_DIR="$DOCKER_DIR/wg-easy"
-    local WEB_PORT="51821" VPN_PORT="51820"
+    local WEB_PORT="51831" VPN_PORT="51830"
 
     if [ "$DRY_RUN" = true ]; then
         echo "[DRY-RUN] wg-easy would:"
@@ -221,7 +231,7 @@ install_wg-easy() {
         echo "  - Auto-detect public IP for WG_HOST"
         echo "  - Generate a random web UI password"
         echo "  - Pin WG_DEFAULT_ADDRESS=10.8.0.x (subnet 10.8.0.0/24)"
-        echo "  - Expose port 51821 (web UI) + 51820/udp (VPN), both auto-scanned if occupied"
+        echo "  - Expose port 51831 (web UI) + 51830/udp (VPN), both auto-scanned if occupied"
         echo "  - Require router port-forward: UDP <VPN port> → this server"
         echo "  - Offer a Caddy reverse proxy and to start the container"
         echo "  - Offer to also allow SSH from the VPN subnet (additive, doesn't remove public SSH)"
@@ -232,7 +242,7 @@ install_wg-easy() {
     # Scan for free host ports, moving both together — a plain install
     # shouldn't silently claim a port another already-running service holds.
     # Whatever VPN_PORT ends up as is what needs forwarding on the router
-    # (the messaging below reflects the final value, not the 51820 default).
+    # (the messaging below reflects the final value, not the 51830 default).
     # See CLAUDE.md's "Port collision avoidance" section.
     while port_in_use "$WEB_PORT" || port_in_use "$VPN_PORT" udp; do
         WEB_PORT=$((WEB_PORT + 1))