refactor: Angie → nginx + Unbound (DNS Forwarder + Cluster-Split-Horizon)

Reverse-Proxy von Angie (eigenes APT-Repo) auf nginx (Distro) umgestellt
— vereinfacht Bootstrap (kein angie.software-Repo mehr), reduziert
Offene-Punkte (arm64-Verfügbarkeit entfällt). Neuer Service Unbound
übernimmt zwei Rollen: Caching-Forwarder mit DNSSEC und Cluster-internes
Split-Horizon (Local-Zone eg.cluster, Peer-Adressen aus PG ha_nodes,
Reload via unbound-control). Architektur-Spec §7.5 dokumentiert beide
Rollen + Config-Schichtung.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

agent.md

@@ -19,7 +19,7 @@ Der Architect Center Orchestrator dispatcht mehrere Claude Code Agenten, jeder s
 |-------|-------|-----------------|
 | **DB-Architect** | Datenbankschema, goose-Migrations, GORM-Models | mail-gateway models/ |
 | **API-Engineer** | Gin-Router, alle Handler, Middleware (Auth/JWT/RBAC) | mail-gateway handlers/ |
-| **Config-Generator** | HAProxy, Angie, Squid, WireGuard, nftables Templates + Renderer | mail-gateway config/ |
+| **Config-Generator** | HAProxy, nginx, Squid, WireGuard, Unbound, nftables Templates + Renderer | mail-gateway config/ |
 | **Cluster-Engineer** | KeyDB AA, PG Streaming Replication, Join/Promote, Write-Proxy | mail-gateway cluster/ |
 | **Scheduler-Engineer** | ACME-Renewal, Backup, Health-Aggregation, License-Heartbeat | mail-gateway scheduler |
 | **CLI-Engineer** | edgeguard-ctl: initdb, migrate, cluster-join, promote, dump-config | mail-gateway cmd/nmg-ctl/ |
@@ -38,7 +38,7 @@ Phase 1 (parallel):
 
 Phase 2 (parallel, braucht Phase 1):
   API-Engineer       → internal/handlers/ + cmd/edgeguard-api/
-  Config-Generator   → internal/{haproxy,angie,squid,wireguard,firewall}/
+  Config-Generator   → internal/{haproxy,nginx,squid,wireguard,unbound,firewall}/
   CLI-Engineer       → internal/services/ + cmd/edgeguard-ctl/
 
 Phase 3 (parallel, braucht Phase 2):