routes: align overlapping subnet 4via6 setup

funnel: reconcile legacy ports and auto queue dns01

funnel: allow dns-01 before route activation

funnel: fix cert actions and startup reporting

funnel: add dnsmgr dns-01 certificates

funnel: accept string IDs when creating services

funnel: make cert actions and status honest

funnel: accept trailing-dot managed dns targets

funnel: improve UX and sync managed domains

funnel: scope official caps to eligible nodes

funnel: prewire official ingress dns

funnel: extend official client compatibility

exit: trim selected peer subnet routes

share: masquerade direct-share peer addresses

share: prefer active exit-selected hidden peers