fix(svc-net-tor): drop the dnsmasq keyword the RedHat family already sets

EL10 and Fedora ship an active local-service=host in /etc/dnsmasq.conf. The drop-in repeated the keyword, and dnsmasq refuses a repeated ARG_ONE option: 'illegal repeated keyword at line N of /etc/dnsmasq.d//tor-onion.conf', then 'FAILED to start up'. Eight CI rows died at roles/svc-net-tor/tasks/router.yml:67, all of them on centos or fedora; arch and ubuntu start dnsmasq fine because their stock config leaves the keyword commented.

The line never took effect on any distribution. dnsmasq resets OPT_LOCAL_SERVICE as soon as an access-control option is present, and listen-address fills exactly that list; the template emits listen-address=127.0.0.1 unconditionally in the same block. A query from a source outside every directly attached subnet is answered identically with and without the line.

Port 53 therefore carries no source restriction. That is unchanged here and belongs in the nftables guard, which currently covers only the trans, DNS and SOCKS ports of tor itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/svc-net-tor/templates/dnsmasq-tor-onion.conf.j2

@@ -4,7 +4,6 @@ listen-address=127.0.0.1
 listen-address={{ TOR_CONTAINER_DNS_HOST }}
 {% endif %}
 bind-interfaces
-local-service
 no-resolv
 {% endif %}
 no-hosts