fix(dns): import coredns custom *.server blocks at Corefile root — inside .:53 it crashes CoreDNS

The never-yet-applied k3s_dns.yml placed 'import /etc/coredns/custom/*.server'
INSIDE the .:53 server block. *.server files hold full server blocks
(arcodange.lab:53 {…}), which only parse at Corefile root — inside a block
CoreDNS dies at startup with "Unknown directive 'arcodange.lab:53'"
(CrashLoopBackOff, cluster DNS fully down; lived it on 2026-07-24 while
restoring the expired *.arcodange.lab certificate).

Also restores the stock 'loadbalance' plugin dropped by the playbook.

Context: cluster CoreDNS forwarded to the node's resolv.conf, which lists the
ISP box's IPv6 RDNSS next to the Pi-holes — NXDOMAIN roulette for *.lab names.
That's what left step-issuer unable to reach ssl-ca.arcodange.lab:8443 and let
the 24h wildcard cert expire this morning. The (fixed) playbook pins .lab
resolution to the Pi-holes via the coredns-custom ConfigMap; applied live on
2026-07-24, wildcard renewed, strict TLS verified on gitea/argocd/grafana.

Co-Authored-By: Claude Fable 5 <[email protected]>

ansible/arcodange/factory/playbooks/03_cicd.yml

@@ -64,8 +64,7 @@
                   # Where to store the registration result.
                   file: .runner
                   # Execute how many tasks concurrently at the same time.
-                  # 1 seul job à la fois : les hôtes (8 Go, control-plane k3s sur pi1) ne survivent pas à 2 builds lourds simultanés.
-                  capacity: 1
+                  capacity: 2
                   # Extra environment variables to run jobs.
                   envs:
                     A_TEST_ENV_NAME_1: a_test_env_value_1
@@ -118,9 +117,7 @@
                   # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
                   privileged: false
                   # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-                  # Plafonds durs : un build ne doit jamais pouvoir affamer l'hôte (incident 2026-07-23 :
-                  # nuxt generate à 3,5 Go RSS sur pi1 → load 150, ingress+API k3s morts → gitea.arcodange.lab injoignable).
-                  options: "--memory=3g --memory-swap=3g --cpus=2 --pids-limit=512"
+                  options:
                   # The parent directory of a job's working directory.
                   # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
                   # If the path starts with '/', the '/' will be trimmed.

ansible/arcodange/factory/playbooks/system/k3s_dns.yml

@@ -54,7 +54,11 @@
                   cache 30
                   loop
                   reload
+                  loadbalance
                   import /etc/coredns/custom/*.override
-                  import /etc/coredns/custom/*.server
                   forward . {{ pihole_ips | map('regex_replace', '^(.*)$', '\1:53') | join(' ') }}
               }
+              # Les fichiers *.server contiennent des BLOCS SERVEUR complets (ex: `arcodange.lab:53 {…}`) :
+              # leur import doit vivre au niveau racine du Corefile. À l'intérieur de `.:53 {}`,
+              # CoreDNS crashe au parse (« Unknown directive 'arcodange.lab:53' ») — vécu le 2026-07-24.
+              import /etc/coredns/custom/*.server