Document ListRecords filtering, gRPC examples, and expand CLAUDE.md

ARCHITECTURE.md:
- Note optional ?name=/&type= query filters on GET /v1/zones/{zone}/records
- Document ListRecordsRequest name/type fields as optional filters in gRPC service
- Add gRPC usage examples section with grpcurl commands

CLAUDE.md:
- Add mcdsl shared library section
- Add testing patterns (stdlib only, real SQLite, no mocks)
- Add key invariants: SOA serial YYYYMMDDNN format, CNAME exclusivity at DB layer

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -56,6 +56,27 @@ deploy/              Docker, systemd, install scripts, examples
 - `srv/` — local dev runtime data
 - `gen/` — regenerated from proto, not hand-edited
 
+## Shared Library
+
+MCNS uses `mcdsl` (git.wntrmute.dev/kyle/mcdsl) for shared platform packages:
+auth, db, config, httpserver, grpcserver. These provide MCIAS authentication,
+SQLite database helpers, TOML config loading, and TLS-configured HTTP/gRPC
+server scaffolding.
+
+## Testing Patterns
+
+- Use stdlib `testing` only. No third-party test frameworks.
+- Tests use real SQLite databases in `t.TempDir()`. No mocks for databases.
+
+## Key Invariants
+
+- **SOA serial format**: YYYYMMDDNN, auto-incremented on every record mutation.
+  If the date prefix matches today, NN is incremented. Otherwise the serial
+  resets to today with NN=01.
+- **CNAME exclusivity**: Enforced at the DB layer within transactions. A name
+  cannot have both CNAME and A/AAAA records. Attempts to violate this return
+  `ErrConflict`.
+
 ## Critical Rules
 
 1. **REST/gRPC sync**: Every REST endpoint must have a corresponding gRPC