Carve webmention.alunduil.com out of dns.tf

## Summary

Note in `terraform/alunduil/dns.tf` that `webmention.alunduil.com` is owned
outside Terraform, once the record exists.

## Motivation

`dns.tf`'s header claims every record except `home.alunduil.com` is
Terraform-managed. Deploying the relay in alunduil/blog.alunduil.com#681
creates a second one that isn't: attaching the Worker's custom domain creates
the record and its certificate.

Without the note, the next session reading that header sees a record with no
declaration and adds a `cloudflare_dns_record` for it — which then fights the
blog's deploy on every plan. That's the same failure the existing
`home.alunduil.com` comment prevents for the TrueNAS DDNS client.

## Scope

- Amend the `dns.tf` header and add a carve-out comment matching the shape of
the `home.alunduil.com` one.

## Acceptance criteria

- [ ] `dns.tf` explains why `webmention.alunduil.com` has no
`cloudflare_dns_record` and what owns it.

## Additional context

Deliberately not landed with #260: the record won't exist until the blog
deploys the Worker, and documenting absent state would describe something a
reader can't verify. Blocked until alunduil/blog.alunduil.com#681 ships.