docs: AdGuard Home migration - MikroTik persistence fix, Unraid replaces Pi-hole

- Fixed MikroTik AdGuard container persistence (disk1 root + usb1 mount)
- Deployed AdGuard Home on Unraid at 192.168.31.4 (replacing Pi-hole)
- Synced configuration: 6 clients, Quad9 DoH, TLS certs, filtering rules
- Added Mermaid diagrams for network topology and DNS architecture

docs/06-CHANGELOG.md

@@ -3,6 +3,31 @@
 ### Pi-hole Removal from MikroTik
 - [CONTAINER] Removed Pi-hole container from MikroTik
 - [STORAGE] Freed internal flash storage
+## 2026-01-22 - AdGuard Home Migration Complete
+
+### MikroTik AdGuard Home - Persistence Fix
+- [CONTAINER] Fixed container persistence issue (root-dir on disk1, data on usb1)
+- [CONFIG] Container now survives stop/start cycles
+- [MOUNT] agh-work mount: usb1/adguard-home/work → /opt/adguardhome/work
+
+### Unraid AdGuard Home - Replaces Pi-hole
+- [CONTAINER] Deployed AdGuard Home on br0 macvlan network
+- [IP] 192.168.31.4 (same IP as Pi-hole was using)
+- [STOPPED] binhex-official-pihole container stopped (not removed)
+- [CONFIG] Same credentials and rules as MikroTik instance
+
+### Configuration Sync (Both Instances)
+- [DNS] Upstream: Quad9 DoH (dns10.quad9.net)
+- [TLS] Let's Encrypt wildcard cert for *.xtrm-lab.org
+- [CLIENTS] 6 clients configured with MAC addresses
+- [RULES] Custom filtering rules for SentinelOne, Jamf
+
+### Documentation
+- [DOCS] Updated 00-CURRENT-STATE.md with Mermaid diagrams
+- [DIAGRAM] Added network topology and DNS architecture diagrams
+
+---
+
 - [CLEANUP] Removed Pi-hole mounts, envs, and data
 
 ### AdGuard Home Installation (Multiple Attempts)