Surface the DC WireGuard port conflict in the troubleshooting flow (#853)

Link the existing "WireGuard port conflict on Domain Controllers"
guidance (on /manage/dns/internal-dns-servers) from two pages a
troubleshooting-hub user could not previously reach it from:

- Windows client troubleshooting: a bullet under Windows DNS scenarios
  for the "NetBird won't start on a DC" symptom.
- DNS troubleshooting: a note after the AD/DC issue, disambiguating the
  client-running-on-the-DC case.

No content duplicated; both are pointers to the one existing section.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

src/pages/manage/dns/troubleshooting.mdx

@@ -473,6 +473,10 @@ A domain resource only resolves `A`/`AAAA` records. Active Directory also depend
 - Add a **DNS nameserver** with match domain `corp.example.com` pointing at the DC's IP, distributed to your remote-users group — see [Active Directory & Windows File Shares → Give clients corp DNS](/use-cases/remote-access/active-directory#step-5-give-clients-corp-dns).
 - Confirm the DC itself is reachable through the routing peer on the AD ports — see [Reaching a Domain Controller through a routing peer](/manage/dns/internal-dns-servers#reaching-a-domain-controller-through-a-routing-peer).
 
+<Note>
+Running the NetBird client directly **on** a Domain Controller is a separate case: it can fail to start when the Windows DNS Server service has already claimed WireGuard's UDP port 51820. See [WireGuard port conflict on Domain Controllers](/manage/dns/internal-dns-servers#wire-guard-port-conflict-on-domain-controllers).
+</Note>
+
 ---
 
 ### Issue 8: Windows NRPT rule is written but never takes effect (lingering GPO)