A few years ago a friend gave me an "Urban Shop" glitter lamp as a gift. It was a neat twist on a lava lamp that used LEDs and glitter with a motor that spun the fluid using a magnetic string bar.
While it was a great vibe, it used three AA batteries and the stirring would cycle on and off regularly causing the noise to start and stop, which I found more distracting than just leaving it on.
I found that the on-off switch was actual an on-on switch without a second connection, so I took an old USB cable and hardwired the second switch terminal so that I could power it from a power supply or batteries.
This was a drastic improvement to me, but I didn't like the cord always being attached and the motor cycling was still annoying. Eventually, the lamp ended up on a shelf for a later date.
Today, I pulled the lamp down because I finally tried ESPHome because I keep hearing about it in other people's projects and wanted to finally try the full smart conversion of this lamp. After several hours of trying to reuse the existing surface-mount LEDs and wiring, I gutted the whole damn thing and installed my own 5mm LEDs, rewired the motor, and added a button for controls and wired everything into a Raspberry Pi Pico W I had bought years ago.
Now I have a lamp that can be controlled locally from the button, can be reprogrammed from my computer without moving the lamp, can be controlled from Home Assistant, and performs exactly how I want.
I run AdGuard as an addon to Home Assistant. If you want to stick to AdGuard you can go to Settings > Client Settings and set a per-client filtering rule. There is a tab in the client settings that can be used to filter specific services with a click. Setting an IP reservation for your child's device in the DHCP settings of Unifi or your router will help ensure the IP address stays consistent.
For the PiHole option, you don't actually have to let the PiHole handle DHCP. You just need to tell your DHCP server what DNS server to use. For example, my router is .1 and my Raspberry PI is .2. The DHCP server, my router, tells all devices .1 is the gateway and .2 is the DNS server. You may also need to set these settings on the individual devices to prevent them from ignoring your DNS settings, but that can be done from the network settings. Avast had some safe networking "feature" that would force my DNS settings to be ignored, same with my Android phone.
Of course, the downside to all of this is that any different device, different IP, device from a friend, or mobile data could bypass these restrictions. You may soon be in an arms race with your child and chances are they can get more clever that you can in a shorter time frame.