Apply review fixes: validation, idempotency, SOA dedup, startup cleanup

- Migration v2: INSERT → INSERT OR IGNORE for idempotency
- Config: validate server.tls_cert and server.tls_key are non-empty
- gRPC: add input validation matching REST handlers
- gRPC: add logger to zone/record services, log timestamp parse errors
- REST+gRPC: extract SOA defaults into shared db.ApplySOADefaults()
- DNS: simplify SOA query condition (remove dead code from precedence bug)
- Startup: consolidate shutdown into shutdownAll(), clean up gRPC listener
  on error path, shut down sibling servers when one fails

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/grpcserver/server.go

@@ -33,8 +33,8 @@ func New(certFile, keyFile string, deps Deps, logger *slog.Logger) (*Server, err
 
 	pb.RegisterAdminServiceServer(srv.GRPCServer, &adminService{db: deps.DB})
 	pb.RegisterAuthServiceServer(srv.GRPCServer, &authService{auth: deps.Authenticator})
-	pb.RegisterZoneServiceServer(srv.GRPCServer, &zoneService{db: deps.DB})
-	pb.RegisterRecordServiceServer(srv.GRPCServer, &recordService{db: deps.DB})
+	pb.RegisterZoneServiceServer(srv.GRPCServer, &zoneService{db: deps.DB, logger: logger})
+	pb.RegisterRecordServiceServer(srv.GRPCServer, &recordService{db: deps.DB, logger: logger})
 
 	return s, nil
 }