docs: add live-verified LAN overview; refresh gfw facts

hosts/gfw.windy.lan.md

@@ -6,17 +6,24 @@
 |---|---|
 | Role | LAN gateway and OpenClash transparent/explicit-proxy host |
 | IPv4 | `192.168.66.1` |
-| SSH | `ssh -4 root@192.168.66.1` |
-| OS | OpenWrt, Linux `6.12.87` |
+| SSH | `ssh -4 root@192.168.66.1` (key-only, verified 2026-08-06) |
+| OS | ImmortalWrt 25.12.0 (r37854), Linux `6.12.87`, x86/64 |
 
-Do not store the root password in this repository. Prefer a verified SSH key for
-future management access.
+Do not store the root password in this repository.
 
 ## OpenClash
 
-OpenClash runs `/etc/openclash/clash` with configuration
+OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
 `/etc/openclash/pass-cat.yaml`.
 
+- Mode: **fake-ip + TPROXY transparent proxy** (`operation_mode=fake-ip`,
+  `en_mode=fake-ip`, `proxy_mode=rule`); fake-ip network `198.18.0.0/16`
+- DNS path: dnsmasq → clash DNS `127.0.0.1#7874` (`server=127.0.0.1#7874` in
+  dnsmasq config); `mosdns` also listens on `127.0.0.1:6052` but is not the
+  active resolver path
+- nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into
+  `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)
+
 | Listener | Port |
 |---|---:|
 | HTTP | `7890` |
@@ -25,6 +32,7 @@ OpenClash runs `/etc/openclash/clash` with configuration
 | Mixed | `7893` |
 | TPROXY | `7895` |
 | DNS | `7874` |
+| Dashboard | `9090` |
 
 `8443` is not an OpenClash listener and has no runtime nftables forwarding rule.
 It is included only in OpenClash's common TLS-sniffing port list.