Encrypted DNS setup

  Sets up Cloudflare Gateway DNS (DoH/DoT) on UniFi, Linux, Windows, macOS
  and iOS. Agents: start with /llms.txt. The whole guide as Markdown:

  GET /guide.md?endpoint=https://<host>/dns-query[&device=unifi|linux|windows|apple]

  GET /api/stamp?url=https://<host>/<path>
    sdns:// stamp for UniFi and other DNSCrypt-style clients.
    props=<n>     bitmask: 1=DNSSEC, 2=no logs, 4=no filter (default 7)
    addr=<ip>     fixed IP:port; leave empty for anycast endpoints
    hash=<hex>    certificate SHA-256 (repeat for more than one hash)
    format=json   JSON response

  GET /api/resolve?host=<hostname>
    IPv4 and IPv6 addresses of the endpoint, as JSON.

  GET /profile.mobileconfig?url=https://<host>/<path>[&ssid=<name>…]
    Apple configuration profile (iOS, iPadOS, macOS). Each ssid= is a Wi-Fi
    network where the profile stays off.

Example:
  GET /api/stamp?url=https://hkk2fnlpfy.cloudflare-gateway.com/dns-query