DoH at /dns-query, admin UI at random /adg-<rand>/ path. AGH binds
localhost only (web UI + plain DNS on random ports); nginx bridges both
paths on the existing panel vhost, so no new domain, cert, or open port.
Config pre-seeded (no wizard), bcrypt password via htpasswd, re-run
safe, -uninstall y supported.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
