Split unbound into its own app directory

unbound was bundled inside apps/pihole/ and invisible in the apps/
listing. Now apps/unbound/ (deployment + service + kustomization); it
stays in the pihole namespace, whose Namespace object remains owned by
apps/pihole. No resource changes — server-side dry-run clean (36
resources).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - apps/home-assistant
   - apps/nginx
   - apps/pihole
+  - apps/unbound
   - apps/unified-streaming