feat(security): expose internal services and DoH to public

- Remove `internalOnly = true` flag from Vaultwarden, Forgejo, and AdGuard Home to make them publicly accessible again.

- This also re-exposes the DNS-over-HTTPS (DoH) endpoint on the AdGuard Home domain.

modules/adguard.nix

@@ -185,10 +185,9 @@ in
       iptables -t nat -D PREROUTING -i tailscale0 -p tcp --dport 53 -j REDIRECT --to-ports 5353 || true
     '';
 
-    # Nginx reverse proxy for AdGuard Home Web UI (restricted to Tailscale)
+    # Nginx reverse proxy for AdGuard Home Web UI and DoH
     myModules.nginx.domains."${cfg.domain}" = {
       port = cfg.port;
-      internalOnly = true;
       contentSecurityPolicy = null; # AdGuard Home handles its own CSP
     };