doc: FTTH migration — gateway is now 192.168.0.1

The Archer C7 at .2 is gone; the FTTH box at .1 is the gateway. Every
static holdout (nas host, nuc host, privoxy, transmission-bt) pointed at
the dead .2 and had no internet — the reported symptom was privoxy.

Also record two things the migration broke that were not obvious:

- DHCP reservations did not carry over. blocky held .254 by reservation
  on the C7; a lease renew on the FTTH box moved it and took LAN DNS
  down. It is static now. jellyfin-* are still DHCP on stale leases.
- The FTTH box advertises native IPv6. transmission-bt's tunnel is
  AllowedIPs = 0.0.0.0/0, so v6 egressed around the kill switch on the
  home address. IPv6 is now disabled in that container.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

nas/nas-install.md

@@ -324,11 +324,11 @@ allow-hotplug enp0s20f0
 iface enp0s20f0 inet static
     address 192.168.0.4
     netmask 255.255.255.0
-    gateway 192.168.0.2
+    gateway 192.168.0.1
     dns-nameservers 1.1.1.1 9.9.9.9
 ```
 
-(Gateway is **`192.168.0.2`** — `.1` is gone since 2026-08. The host
+(Gateway is **`192.168.0.1`** — the FTTH box, since 2026-09. The host
 uses public resolvers, never blocky, to avoid a bootstrap loop.
 Interface name is a guess until the board is up — check `ip -br link`.)
 
@@ -527,7 +527,7 @@ Its WireGuard tunnel is **entirely inside the container** (`wg0`,
 `10.8.0.21`, `wg-quick@wg0`, `BindsTo=` on the daemon), so the container
 carries its own keys and **ks4 needs no change at all** — the peer stays
 `10.8.0.21/32`. The kill-switch `/32` route points at the gateway
-`192.168.0.2`, which is the same from here.
+`192.168.0.1`, which is the same from here.
 
 ```sh
 # on nuc — remote already added in §9a