Apply review fixes: validation, idempotency, SOA dedup, startup cleanup

- Migration v2: INSERT → INSERT OR IGNORE for idempotency
- Config: validate server.tls_cert and server.tls_key are non-empty
- gRPC: add input validation matching REST handlers
- gRPC: add logger to zone/record services, log timestamp parse errors
- REST+gRPC: extract SOA defaults into shared db.ApplySOADefaults()
- DNS: simplify SOA query condition (remove dead code from precedence bug)
- Startup: consolidate shutdown into shutdownAll(), clean up gRPC listener
  on error path, shut down sibling servers when one fails

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/db/zones.go

@@ -169,6 +169,24 @@ func (d *DB) ZoneNames() ([]string, error) {
 	return names, rows.Err()
 }
 
+// ApplySOADefaults fills in zero-valued SOA parameters with sensible defaults:
+// refresh=3600, retry=600, expire=86400, minTTL=300.
+func ApplySOADefaults(refresh, retry, expire, minTTL int) (int, int, int, int) {
+	if refresh == 0 {
+		refresh = 3600
+	}
+	if retry == 0 {
+		retry = 600
+	}
+	if expire == 0 {
+		expire = 86400
+	}
+	if minTTL == 0 {
+		minTTL = 300
+	}
+	return refresh, retry, expire, minTTL
+}
+
 // nextSerial computes the next SOA serial in YYYYMMDDNN format.
 func nextSerial(current int64) int64 {
 	today := time.Now().UTC()