gateway: change dns.listen default to [::1]:5353

The gateway is designed for systems already serving DHCP and DNS to
a LAN segment (canonically an OpenWrt AP). On those systems port 53
is already taken by the existing resolver, so the prior `[::]:53`
default conflicted with the gateway's intended deployment target out
of the box.

The OpenWrt ipk previously overrode this in its packaged config as a
workaround; matching the source default to what the canonical
deployment actually wants makes the override redundant and removes a
foot-gun for fresh manual Linux-host installs. The redundant
`dns.listen` line in `packaging/openwrt-ipk/files/etc/fips/fips.yaml`
is dropped along with this change.

Operators on a host without a pre-existing resolver on port 53 can
opt back into the wildcard bind by setting `dns.listen: "[::]:53"`
explicitly. The new default binds IPv6 loopback only — Linux IPv6
sockets bound to explicit `::1` do not accept v4-mapped traffic, so
forwarders that reach the gateway over IPv4 loopback need to be
pointed at an explicit IPv4 listen address instead.

Touches the gateway config struct and its default-value test, the
commented-out gateway example in the Debian common fips.yaml, the
OpenWrt ipk config (override removed), the gateway reference /
how-to / design / tutorial / troubleshoot docs, and a CHANGELOG
entry under [Unreleased] -> Changed.

docs/how-to/deploy-gateway.md

@@ -142,7 +142,7 @@ pick a different `fdXX::/N`). The `/112` size yields 65 536 virtual
 IPs, which is the gateway's hard cap regardless of CIDR width.
 
 This minimum config is enough to start the gateway. The `dns.*` block
-is optional and defaults to `listen: "[::]:53"` and
+is optional and defaults to `listen: "[::1]:5353"` and
 `upstream: "[::1]:5354"`. The full block — including `dns.*`,
 `pool_grace_period`, `conntrack.*`, and `port_forwards[]` — is
 documented in
@@ -195,20 +195,28 @@ Constraints:
 ```yaml
 gateway:
   dns:
-    listen: "[::]:53"
+    listen: "[::1]:5353"
     upstream: "[::1]:5354"
     ttl: 60
 ```
 
 Common cases:
 
-- **No other resolver on the host:** `listen: "[::]:53"` is the
-  default and works.
-- **systemd-resolved is on port 53:** either disable its stub
-  listener (`DNSStubListener=no` in
-  `/etc/systemd/resolved.conf`) or move the gateway to a different
-  port (e.g., `[::]:5353`) and put a forwarder on 53 that delegates
-  `.fips` to the gateway. See
+- **Another resolver on the host (the canonical case):** the default
+  `listen: "[::1]:5353"` is loopback-only on an unprivileged port,
+  so it never conflicts with dnsmasq, systemd-resolved, or BIND
+  holding 53. Configure the existing resolver to forward `.fips`
+  queries to `[::1]:5353` and you are done — this is what the
+  OpenWrt ipk does automatically.
+- **No other resolver on the host:** set `listen: "[::]:53"`
+  explicitly and LAN clients can query the gateway directly.
+- **systemd-resolved is on port 53:** the default already side-steps
+  this — leave the listen address at `[::1]:5353` and configure the
+  stub or a small forwarder to delegate `.fips` to the gateway. If
+  you would rather have the gateway on 53 directly, disable the
+  systemd stub listener (`DNSStubListener=no` in
+  `/etc/systemd/resolved.conf`) and switch `listen` to `"[::]:53"`.
+  See
   [troubleshoot-gateway.md](troubleshoot-gateway.md#port-conflict-on-the-dns-listen-port).
 - **Bind on the LAN address only:** `listen: "192.168.1.1:53"`
   exposes the resolver only to LAN clients, not loopback.

docs/how-to/troubleshoot-gateway.md

@@ -82,10 +82,13 @@ for the full flag list.
 ### Port conflict on the DNS listen port
 
 Symptom: gateway fails to start with "address already in use" on
-port 53 (or whatever `gateway.dns.listen` is set to).
+the configured `gateway.dns.listen` address.
 
-Another DNS server (systemd-resolved, dnsmasq, BIND) is bound to
-the port. Identify it:
+The default `[::1]:5353` is loopback-only on an unprivileged port and
+should not collide with any standard resolver. If you have overridden
+`dns.listen` to bind port 53 (or a LAN-side address) and another DNS
+server (systemd-resolved, dnsmasq, BIND) is already bound there,
+identify it:
 
 ```sh
 sudo ss -tulnp | grep ':53'
@@ -93,18 +96,10 @@ sudo ss -tulnp | grep ':53'
 
 Two options:
 
-- **Use an alternate listen address.** Pick a non-conflicting port
-  and update the gateway config:
-
-  ```yaml
-  gateway:
-    dns:
-      listen: "192.168.1.1:5353"
-  ```
-
-  Then either point LAN clients at the alternate port directly, or
-  run a forwarding stub on port 53 that delegates `.fips` queries to
-  the gateway.
+- **Stay on the loopback default.** Drop the override and let the
+  gateway use `[::1]:5353`. Configure the existing resolver to
+  forward `.fips` queries to it (the canonical OpenWrt deployment
+  works this way out of the box).
 
 - **Relocate the conflicting resolver.** Move it to a different port
   (or disable it if not needed) and let the gateway bind 53.
@@ -189,7 +184,7 @@ not running or not enabled. Check that the daemon config has
 **Step 2.** Verify the gateway is listening on its DNS port:
 
 ```sh
-sudo ss -tulnp | grep -E ':53\b'
+sudo ss -tulnp | grep -E ':(53|5353)\b'
 ```
 
 If nothing is listening on the configured `dns.listen` address, the