docs(dns): record mosdns fallback hardening for AGH outage (W1N-56)

hosts/gfw.windy.lan.md

@@ -33,8 +33,10 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
   > 2026-08-12: fixed missing `has_resp → accept` guard after the domestic
   > branch in `/etc/mosdns/config.yaml` (domestic queries were double-forwarded,
   > final answer came from CN public DNS, bypassing AGH blocking/rewrites;
-  > verified via `dup.baidustatic.com` before/after). Backup:
-  > `/etc/mosdns/config.yaml.bak-20260812`. See
+  > verified via `dup.baidustatic.com` before/after); added `domestic_fallback`
+  > (fallback plugin: primary=AGH, secondary=CN public DNS, 500ms) so domestic
+  > DIRECT lookups survive an AGH outage. Backups:
+  > `config.yaml.bak-20260812` / `config.yaml.bak-fallback-20260812`. See
   > [docs/lan-dns-architecture.md](../docs/lan-dns-architecture.md) §1.
 - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into
   `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)