Implement MCNS v1: custom Go DNS server replacing CoreDNS

Replace the CoreDNS precursor with a purpose-built authoritative DNS
server. Zones and records (A, AAAA, CNAME) are stored in SQLite and
managed via synchronized gRPC + REST APIs authenticated through MCIAS.
Non-authoritative queries are forwarded to upstream resolvers with
in-memory caching.

Key components:
- DNS server (miekg/dns) with authoritative zone handling and forwarding
- gRPC + REST management APIs with MCIAS auth (mcdsl integration)
- SQLite storage with CNAME exclusivity enforcement and auto SOA serials
- 30 tests covering database CRUD, DNS resolution, and caching

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,23 @@
+FROM golang:1.25-alpine AS builder
+
+ARG VERSION=dev
+
+RUN apk add --no-cache git
+
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o mcns ./cmd/mcns
+
+FROM alpine:3.21
+
+RUN addgroup -S mcns && adduser -S mcns -G mcns
+COPY --from=builder /build/mcns /usr/local/bin/mcns
+
+USER mcns
+EXPOSE 53/udp 53/tcp 8443 9443
+
+ENTRYPOINT ["mcns"]
+CMD ["server", "--config", "/srv/mcns/mcns.toml"]