fix(mesh): refresh egress DNS with getent and route clients

hosts/heather/mesh-clients.nix

@@ -20,6 +20,12 @@
 
   networking.firewall.allowedUDPPorts = [ 51821 ];
 
+  # allowedIPsAsRoutes=false keeps peer declarations as crypto ACLs; install
+  # the client identity route explicitly, as in the backbone design.
+  networking.interfaces.wg-clients1.ipv4.routes = [
+    { address = "10.0.1.10"; prefixLength = 32; }
+  ];
+
   systemd.tmpfiles.rules = [
     "d /var/lib/wireguard 0700 root root -"
   ];