Split unbound into its own app directory

unbound was bundled inside apps/pihole/ and invisible in the apps/
listing. Now apps/unbound/ (deployment + service + kustomization); it
stays in the pihole namespace, whose Namespace object remains owned by
apps/pihole. No resource changes — server-side dry-run clean (36
resources).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -19,7 +19,8 @@ Each app under `apps/` is a self-contained kustomization
 | searxng | default | searxng.wittyoneoff.com, origin-searxng.wittyoneoff.com |
 | home-assistant | home-assistant | ha.wittyoneoff.com, ha-origin.wittyoneoff.com |
 | nginx | nginx | www.wittyoneoff.com, www.ramonaajj.com |
-| pihole (+unbound) | pihole | admin on :8000 via klipper-lb, DNS on :53 |
+| pihole | pihole | admin on :8000 via klipper-lb, DNS on :53 |
+| unbound | pihole | pi-hole's upstream recursive resolver (ClusterIP only) |
 | unified-streaming | unified-streaming | unified.wittyoneoff.com |
 
 Not in this repo: socktop (own repo + pipeline), rancher/monitoring/logging