fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.

ADR.md

@@ -1176,7 +1176,8 @@ Decision: `vpn-router-resolver.service` runs dnsmasq, bound to the addresses of
 only (`bind-interfaces`), forwarding to resolved's stub on 127.0.0.53, without `/etc/hosts` and
 without forwarding names that have no dot (`domain-needed`). resolved keeps its loopback stubs
 only and stays the router's own resolver, with the upstream servers of the platform. Setup writes
-`/etc/vpn-router/dnsmasq.conf` while IKEv2 or OpenVPN runs and removes the earlier drop-in.
+`/etc/vpn-router/dnsmasq.conf` while IKEv2, OpenVPN or WireGuard runs, opens port 53 there for
+their client networks, and removes the earlier drop-in.
 
 Consequences: Clients resolve the names resolved resolves, Azure's internal names included, but
 not the router's synthesized ones. The package depends on dnsmasq-base. PowerDNS and the clients'