Connectivity Capstone: Repair the Whole Resolution-to-Reachability Stack

A freshly-provisioned host can't reach any of its internal services, and every layer of the connectivity stack is broken at once. Work top-to-bottom and repair all five faults so the box resolves and can reach its services.

1. Name-service order — /etc/nsswitch.conf resolves hosts: via DNS only, so the entries in /etc/hosts are never consulted. Make local files authoritative for hostnames.

2. Stale `/etc/hosts` — the three internal hosts resolve to the wrong addresses. Correct them (see /root/brief.txt).

3. Resolver config — /etc/resolv.conf uses the wrong search domain for the internal zone and lists a dead (blackhole) nameserver ahead of the real resolver. Fix both.

4. Firewall — /etc/nftables.conf drops traffic to the application port. Permit that port in chain input.

5. Static addressing — the NetworkManager keyfile has the wrong static address and gateway for eth0. Correct both (the right values are in /root/brief.txt).

Grading reads the resulting config and runs a live getent resolution check; it does not start any services. Tip: inside many containers /etc/hosts and /etc/resolv.conf are bind mounts, where tools that edit by renaming (sed -i) fail with EBUSY. Rewriting the file's contents (>) works everywhere, so it's the safer habit for these two files.