Implement MCNS v1: custom Go DNS server replacing CoreDNS

Replace the CoreDNS precursor with a purpose-built authoritative DNS
server. Zones and records (A, AAAA, CNAME) are stored in SQLite and
managed via synchronized gRPC + REST APIs authenticated through MCIAS.
Non-authoritative queries are forwarded to upstream resolvers with
in-memory caching.

Key components:
- DNS server (miekg/dns) with authoritative zone handling and forwarding
- gRPC + REST management APIs with MCIAS auth (mcdsl integration)
- SQLite storage with CNAME exclusivity enforcement and auto SOA serials
- 30 tests covering database CRUD, DNS resolution, and caching

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

proto/mcns/v1/admin.proto

@@ -0,0 +1,15 @@
+syntax = "proto3";
+
+package mcns.v1;
+
+option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1";
+
+service AdminService {
+  rpc Health(HealthRequest) returns (HealthResponse);
+}
+
+message HealthRequest {}
+
+message HealthResponse {
+  string status = 1;
+}

proto/mcns/v1/auth.proto

@@ -0,0 +1,26 @@
+syntax = "proto3";
+
+package mcns.v1;
+
+option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1";
+
+service AuthService {
+  rpc Login(LoginRequest) returns (LoginResponse);
+  rpc Logout(LogoutRequest) returns (LogoutResponse);
+}
+
+message LoginRequest {
+  string username = 1;
+  string password = 2;
+  string totp_code = 3;
+}
+
+message LoginResponse {
+  string token = 1;
+}
+
+message LogoutRequest {
+  string token = 1;
+}
+
+message LogoutResponse {}

proto/mcns/v1/record.proto

@@ -0,0 +1,62 @@
+syntax = "proto3";
+
+package mcns.v1;
+
+option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1";
+
+import "google/protobuf/timestamp.proto";
+
+service RecordService {
+  rpc ListRecords(ListRecordsRequest) returns (ListRecordsResponse);
+  rpc CreateRecord(CreateRecordRequest) returns (Record);
+  rpc GetRecord(GetRecordRequest) returns (Record);
+  rpc UpdateRecord(UpdateRecordRequest) returns (Record);
+  rpc DeleteRecord(DeleteRecordRequest) returns (DeleteRecordResponse);
+}
+
+message Record {
+  int64 id = 1;
+  string zone = 2;
+  string name = 3;
+  string type = 4;
+  string value = 5;
+  int32 ttl = 6;
+  google.protobuf.Timestamp created_at = 7;
+  google.protobuf.Timestamp updated_at = 8;
+}
+
+message ListRecordsRequest {
+  string zone = 1;
+  string name = 2;
+  string type = 3;
+}
+
+message ListRecordsResponse {
+  repeated Record records = 1;
+}
+
+message CreateRecordRequest {
+  string zone = 1;
+  string name = 2;
+  string type = 3;
+  string value = 4;
+  int32 ttl = 5;
+}
+
+message GetRecordRequest {
+  int64 id = 1;
+}
+
+message UpdateRecordRequest {
+  int64 id = 1;
+  string name = 2;
+  string type = 3;
+  string value = 4;
+  int32 ttl = 5;
+}
+
+message DeleteRecordRequest {
+  int64 id = 1;
+}
+
+message DeleteRecordResponse {}

proto/mcns/v1/zone.proto

@@ -0,0 +1,65 @@
+syntax = "proto3";
+
+package mcns.v1;
+
+option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1";
+
+import "google/protobuf/timestamp.proto";
+
+service ZoneService {
+  rpc ListZones(ListZonesRequest) returns (ListZonesResponse);
+  rpc CreateZone(CreateZoneRequest) returns (Zone);
+  rpc GetZone(GetZoneRequest) returns (Zone);
+  rpc UpdateZone(UpdateZoneRequest) returns (Zone);
+  rpc DeleteZone(DeleteZoneRequest) returns (DeleteZoneResponse);
+}
+
+message Zone {
+  int64 id = 1;
+  string name = 2;
+  string primary_ns = 3;
+  string admin_email = 4;
+  int32 refresh = 5;
+  int32 retry = 6;
+  int32 expire = 7;
+  int32 minimum_ttl = 8;
+  int64 serial = 9;
+  google.protobuf.Timestamp created_at = 10;
+  google.protobuf.Timestamp updated_at = 11;
+}
+
+message ListZonesRequest {}
+
+message ListZonesResponse {
+  repeated Zone zones = 1;
+}
+
+message CreateZoneRequest {
+  string name = 1;
+  string primary_ns = 2;
+  string admin_email = 3;
+  int32 refresh = 4;
+  int32 retry = 5;
+  int32 expire = 6;
+  int32 minimum_ttl = 7;
+}
+
+message GetZoneRequest {
+  string name = 1;
+}
+
+message UpdateZoneRequest {
+  string name = 1;
+  string primary_ns = 2;
+  string admin_email = 3;
+  int32 refresh = 4;
+  int32 retry = 5;
+  int32 expire = 6;
+  int32 minimum_ttl = 7;
+}
+
+message DeleteZoneRequest {
+  string name = 1;
+}
+
+message DeleteZoneResponse {}