The in-cluster CoreDNS at 10.43.0.10 was returning empty for
demo.flow-master.ai, causing every /api/* proxy_pass to fail with
fast 502 (DNS resolution failure). Add 1.1.1.1 and 8.8.8.8 as
fallbacks so nginx can resolve public hostnames even when CoreDNS
doesn't forward external queries.
Lazy per-request resolution via $variable form preserved.