fix(dns): move local-zone entries before remote-control block

Unbound parses remote-control: as a section boundary. local-zone directives
placed after remote-control: are rejected as syntax errors in this Unbound
version. Moved local-zone entries to before the remote-control block so they
are unambiguously within the server: section.

Author: geeksbsmrt

docker/unbound/unbound.conf.template

@@ -75,12 +75,6 @@ server:
     access-control: ${IP_BLACKBOX}/32 allow
     access-control: 0.0.0.0/0 refuse
 
-    # Enable unbound-control
-    remote-control:
-        control-enable: yes
-        control-interface: 127.0.0.1
-        control-port: 8953
-
     # Block HTTPS (TYPE65/ECH) records for local domains.
     # Cloudflare publishes HTTPS records with ECH params for proxied domains. When
     # PiHole returns local IPs for these domains, Chrome/Safari try to use those
@@ -91,3 +85,9 @@ server:
     # directives) and never reach Unbound, so this does not affect normal resolution.
     local-zone: "geeksbsmrt.com." static
     local-zone: "smrtgeekdevs.com." static
+
+    # Enable unbound-control
+    remote-control:
+        control-enable: yes
+        control-interface: 127.0.0.1
+        control-port: 8953