WiFi VLAN fixes, CAP bridge filtering, AdGuard IP conflicts, channel optimization

- Enable bridge VLAN filtering on CAP for proper per-client VLAN assignment
- Fix AdGuard container IP conflicts (.2→.10, .3→.11) with static IPs
- Fix 2.4GHz co-channel interference (both APs were on ch 1, CAP now ch 6)
- Fix 5GHz overlap (HAP ch 36/5180, CAP moved to ch 52/5260)
- Update WiFi access-list: VLAN assignment now active with per-device VLAN IDs
- Add Xiaomi Air Purifier MC1 to VLAN 30 access-list

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/08-DNS-ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # DNS Architecture with AdGuard Failover
 
-**Last Updated:** 2026-02-06
+**Last Updated:** 2026-02-26
 
 ---
 
@@ -194,8 +194,10 @@ Settings are synced from Unraid (source of truth) to MikroTik every 30 minutes.
 
 ### Sync Container
 
+Container: `adguardhome-sync` at 192.168.10.11 (br0 macvlan, static IP)
+
 ```yaml
-# /mnt/user/appdata/adguard-sync/adguardhome-sync.yaml
+# /mnt/user/appdata/dockge/stacks/adguard-sync/adguardhome-sync.yaml
 cron: "*/30 * * * *"
 runOnStart: true
 
@@ -204,22 +206,13 @@ origin:
   username: jazzymc
   password: 7RqWElENNbZnPW
 
-replicas:
-  - url: http://192.168.10.1:3000
-    username: jazzymc
-    password: 7RqWElENNbZnPW
-
-features:
-  dns:
-    serverConfig: false
-    accessLists: true
-    rewrites: true
-  filters: true
-  clientSettings: true
-  services: true
+replica:
+  url: http://192.168.10.1:3000
+  username: jazzymc
+  password: 7RqWElENNbZnPW
 ```
 
-**Note:** The sync container must be connected to both `dockerproxy` and `br0` networks to reach both AdGuard instances.
+**Note:** The sync container is on the `br0` macvlan network with a static IP to avoid conflicts with infrastructure devices.
 
 ---