Apply review fixes: validation, idempotency, SOA dedup, startup cleanup

- Migration v2: INSERT → INSERT OR IGNORE for idempotency
- Config: validate server.tls_cert and server.tls_key are non-empty
- gRPC: add input validation matching REST handlers
- gRPC: add logger to zone/record services, log timestamp parse errors
- REST+gRPC: extract SOA defaults into shared db.ApplySOADefaults()
- DNS: simplify SOA query condition (remove dead code from precedence bug)
- Startup: consolidate shutdown into shutdownAll(), clean up gRPC listener
  on error path, shut down sibling servers when one fails

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/zones.go

@@ -72,18 +72,7 @@ func createZoneHandler(database *db.DB) http.HandlerFunc {
 		}
 
 		// Apply defaults for SOA params.
-		if req.Refresh == 0 {
-			req.Refresh = 3600
-		}
-		if req.Retry == 0 {
-			req.Retry = 600
-		}
-		if req.Expire == 0 {
-			req.Expire = 86400
-		}
-		if req.MinimumTTL == 0 {
-			req.MinimumTTL = 300
-		}
+		req.Refresh, req.Retry, req.Expire, req.MinimumTTL = db.ApplySOADefaults(req.Refresh, req.Retry, req.Expire, req.MinimumTTL)
 
 		zone, err := database.CreateZone(req.Name, req.PrimaryNS, req.AdminEmail, req.Refresh, req.Retry, req.Expire, req.MinimumTTL)
 		if errors.Is(err, db.ErrConflict) {
@@ -117,18 +106,7 @@ func updateZoneHandler(database *db.DB) http.HandlerFunc {
 			writeError(w, http.StatusBadRequest, "admin_email is required")
 			return
 		}
-		if req.Refresh == 0 {
-			req.Refresh = 3600
-		}
-		if req.Retry == 0 {
-			req.Retry = 600
-		}
-		if req.Expire == 0 {
-			req.Expire = 86400
-		}
-		if req.MinimumTTL == 0 {
-			req.MinimumTTL = 300
-		}
+		req.Refresh, req.Retry, req.Expire, req.MinimumTTL = db.ApplySOADefaults(req.Refresh, req.Retry, req.Expire, req.MinimumTTL)
 
 		zone, err := database.UpdateZone(name, req.PrimaryNS, req.AdminEmail, req.Refresh, req.Retry, req.Expire, req.MinimumTTL)
 		if errors.Is(err, db.ErrNotFound) {