Pin the resolver to a tag that exists

The dnsmasq image was pinned to 2.90-r0, which is not published. The gateway
therefore never started — correctly reported as not ready, so no client was
handed a resolver that was not there, but the tunnel console did not come up
either.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -96,7 +96,7 @@ services:
   # Both are optional: an installation without VPN_INTERNAL_HOST configured
   # simply does not start them (profile `vpn`).
   vpn-dns:
-    image: 4km3/dnsmasq:2.90-r0
+    image: 4km3/dnsmasq:2.90-r3
     restart: unless-stopped
     profiles: ["vpn"]
     network_mode: "service:queue-provisioning"