nuc: document LAN gateway migration 192.168.0.1 -> 192.168.0.2

Update host NIC/interfaces (gw + DNS to public 1.1.1.1/9.9.9.9, no
container dependency), fix transmission-bt kill-switch routes, and add a
note that DHCP instances self-heal while static ones (privoxy,
transmission-bt) must be updated by hand. Also spell out the macvlan
test-from-inside/external-host rule.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nuc/nuc-install.md

@@ -12,7 +12,7 @@ How to rebuild the Incus host from scratch if `/dev/sda` (512 GB SSD,
   `usb4t/media` → `/srv/media` (media library)
 - USB: Pioneer USB audio (`08e4:0176`), Logitech Unifying receiver (K400),
   CSCTEK USB Audio and HID
-- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.1`)
+- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.2`)
 
 ## ⚠️ What dies with sda
 
@@ -87,8 +87,8 @@ allow-hotplug enp1s0
 iface enp1s0 inet static
     address 192.168.0.3
     netmask 255.255.255.0
-    gateway 192.168.0.1
-    dns-nameservers 192.168.0.1 1.1.1.1
+    gateway 192.168.0.2
+    dns-nameservers 1.1.1.1 9.9.9.9
 ```
 
 Restore `/root/.ssh/authorized_keys` (3 keys; one is `id_rsa_claude.pub`
@@ -161,7 +161,17 @@ EOF
 
 Known macvlan quirk: the **host cannot talk to its own instances** (and
 vice versa) over macvlan — management is via `incus exec`, and other LAN
-hosts reach them normally.
+hosts reach them normally. (So test a container's LAN service from inside
+the container or from an external LAN host — never by pinging its IP from
+the nuc or a sibling container; that always fails by design.)
+
+LAN gateway note: the router/gateway is **`192.168.0.2`** (migrated from
+`192.168.0.1`, 2026-08 — `.1` is gone). DHCP-configured instances pick the
+new gateway up automatically; **statically-configured ones must be updated
+by hand.** Current static holdouts: privoxy
+(`/etc/systemd/network/eth0.network`, `Gateway=`) and transmission-bt
+(netplan `routes: via:` + the WG kill-switch `/32`). Symptom of a missed
+one: the service is up and its port answers, but nothing it fetches works.
 
 Let `julien` run harmless incus commands (list/info/config/show…)
 without a password — mutating ones (`exec`, `start/stop`, `delete`)
@@ -258,7 +268,7 @@ Both logs rotate monthly (`/etc/logrotate.d/incus-*`).
 - [ ] Jellyfin web at `http://192.168.0.5:8096`, kiosk UI on HDMI,
       sound on the Pioneer, "Pioneer A-70" visible in Spotify Connect
 - [ ] LAN DNS: clients use blocky at `192.168.0.254` (host itself uses
-      `192.168.0.1` + `1.1.1.1` to avoid a bootstrap loop)
+      public `1.1.1.1` + `9.9.9.9`, never blocky, to avoid a bootstrap loop)
 - [ ] Optional (only if QSV low-power encoders are wanted):
       `echo 'options i915 enable_guc=3' > /etc/modprobe.d/i915.conf
       && update-initramfs -u`