## `omarchy dns Custom` silently breaks internet access when pointed at DNS-over-TLS-only resolvers (e.g. Mullvad)

### What happened

I tried to configure my system to use Mullvad's privacy-focused DNS resolver (`base.dns.mullvad.net`, IPs `194.242.2.4` / `2a07:e340::4`) using the DNS menu (`omarchy dns` → `Custom`), entering those IPs exactly as the prompt asked:

```
Enter your DNS servers (space-separated, e.g. '192.168.1.1 1.1.1.1'):
194.242.2.4 2a07:e340::4
```

Right after applying, my internet connection appeared to break — no website would load, even though the network itself was fine.

### Why this happens

Mullvad's DNS servers (and other privacy-oriented resolvers like it) don't answer plain, unencrypted DNS queries on port 53. They only answer encrypted queries, over DNS-over-TLS (port 853) or DNS-over-HTTPS (port 443).

Looking at `omarchy-dns` (the script behind the `omarchy dns` command), the `Custom` option writes the IPs straight into `/etc/systemd/resolved.conf` as a plain `DNS=` line, with no `DNSOverTLS=` setting and no TLS server-name annotation:

```
[Resolve]
DNS=194.242.2.4 2a07:e340::4
FallbackDNS=9.9.9.9#dns.quad9.net ...
```

Because `DNSOverTLS` is never set, systemd-resolved defaults to sending plain, unencrypted queries — which a DoT/DoH-only server like Mullvad's simply doesn't answer. The result looks exactly like a broken internet connection, with no error message pointing at DNS at all.

The interesting part: the built-in `Cloudflare` and `Google` presets in the same script *do* handle this correctly. They write the same plain IPs for NetworkManager, but for `/etc/systemd/resolved.conf` they add both a TLS server name and `DNSOverTLS=opportunistic`:

```
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com ...
DNSOverTLS=opportunistic
```

So the fix already exists in the codebase for the two built-in providers — the `Custom` path just never got the same treatment, which makes sense for a plain resolver like a router IP, but silently breaks for any encrypted-only public resolver a user types in.

### Steps to reproduce

1. Run `omarchy dns Custom`
2. Enter `194.242.2.4 2a07:e340::4` (Mullvad's `base.dns.mullvad.net`)
3. Try to load any website — resolution fails, looks like the network is down

### Expected behavior

Either:
- `Custom` should offer a way to opt into DNS-over-TLS (asking for the server's hostname, then writing `IP#hostname` + `DNSOverTLS=opportunistic`, same as the `Cloudflare`/`Google` presets), or
- At minimum, the failure shouldn't be silent — some validation or a warning that plain DNS was configured and may not work with all resolvers would have saved me a very confusing "why is my internet broken" moment.

### Workaround (for anyone else finding this)

After running `omarchy dns Custom` with the IPs, manually add the TLS hostname and encryption flag to `/etc/systemd/resolved.conf`:

```
[Resolve]
DNS=194.242.2.4#base.dns.mullvad.net 2a07:e340::4#base.dns.mullvad.net
DNSOverTLS=opportunistic
```

Then reload: `sudo systemctl reload systemd-resolved.service`

### System details

- Omarchy version: 4.0.1-1
- Command affected: `omarchy dns Custom` (`omarchy-dns` script)

I'm happy to help test a fix if useful. Thanks for Omarchy — this is the only rough edge I've hit so far!