milestone 11: systemd and docker packaging, operator and architecture docs, config and api reference, docs drift guards

PLAN.md

@@ -54,7 +54,7 @@ Serves a household LAN (≈2–20 devices). Portfolio-grade public repo with ext
 Zig 0.16 stdlib is built on the `std.Io` interface: `std.Io.net` owns networking (`std.net` in its old form is gone) and `std.http.Client` requires an `io: Io`. Therefore:
 
 - **`Io` is the injected platform abstraction.** Every component that does I/O takes `io: Io`. No project-owned wrapper interfaces around it — a second abstraction over an abstraction with one consumer is waste.
-- **Backend: `std.Io.Threaded` by default** — the mature, debuggable path; at ≤20 devices throughput is a non-issue. `std.Io.Evented` (io_uring) is selectable via config flag; the code is backend-agnostic by construction, so this is a switch, not a refactor.
+- **Backend: `std.Io.Threaded`** — the mature, debuggable path; at ≤20 devices throughput is a non-issue. The originally planned io_uring config flag was dropped in milestone 11: `std.Io.Evented` at Zig 0.16.0 stubs the networking a server needs — listen, accept, connect, lookup, and stream reads/writes return `error.NetworkDown` (`Uring.zig` netListenIp/netAccept/netConnectIp/netRead/netWrite) — so a selectable backend would boot a dead server. The code stays backend-agnostic by construction; revisit when std ships working evented networking.
 - No hand-written thread pool. `Io` async/concurrent/Group covers task management.
 - Core domain modules (`dns`, `filter`, `cache`) stay pure: no `Io`, no sockets — bytes in, bytes out. Only servers, upstream clients, and storage touch `Io`.
 
@@ -476,7 +476,6 @@ Periodic delete of rows older than `retention_days`; scheduled checkpoint/VACUUM
 .{
     .upstream = .{
         .servers = .{ "https://cloudflare-dns.com/dns-query", "tls://dns.google:853" },
-        .connect_timeout_ms = 2000,
         .read_timeout_ms = 3000,
     },
     .dns = .{
@@ -683,7 +682,7 @@ Exit: documented deployment works end-to-end on the Pi 5.
 | B | Rule kinds: exact, parent-walk, wildcard. Regex permanently out of scope |
 | C | In scope: local DoH/DoT server, local records, conditional forwarding. Out: HTTP/2, DoQ, DHCP, DNSSEC, clustering |
 | D | mbedTLS (vendored) terminates server TLS; stdlib TLS for upstream client |
-| E | `std.Io` injected everywhere; `Threaded` default backend, io_uring via flag; no custom thread pool |
+| E | `std.Io` injected everywhere; `Threaded` backend (io_uring flag dropped in m11 — Evented networking is stubbed at 0.16.0); no custom thread pool |
 | F | Config format: ZON via `std.zon`; DB is truth; export/import for backup + host moves |
 | G | SQLite vendored amalgamation + own thin wrapper |
 | H | Two DBs: `config.db` (precious) + `querylog.db` (expendable, self-contained, client IP as text) |