Read mesh host map from clan zerotier vars instead of hardcoding

The control/ns1/ns2 mesh IPs and the /88 subnet were duplicated literals in
mesh-hosts.nix. clan-core's zerotier generator already writes each machine's IP
as a public var (vars/per-machine/<m>/zerotier/zerotier-ip), so read from there
and derive the subnet from zerotier-network-id. Pure refactor: the rendered
values are identical and the system derivation hash is unchanged.

modules/dns/authoritative.nix

@@ -1,7 +1,7 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 let
   # ZeroTier addresses — zone transfers run over the mesh, not the public net.
-  mesh = import ../mesh-hosts.nix;
+  mesh = import ../mesh-hosts.nix { inherit config lib; };
   ns1zt = mesh.hosts.ns1;
   ns2zt = mesh.hosts.ns2;
 in