Deploy: read cluster objects, drop the zones and RPZ ConfigMaps

DO NOT SYNC THIS BEFORE MIGRATING. Removing fancy-dns-zones and fancy-dns-rpz
from the kustomization lets a pruning GitOps tool delete them, and they hold the
only copy of the zones and address redirects until the objects exist. Follow
deploy/MIGRATION.md: install the definitions, run `fancy-dns-console migrate`
against the live cluster, then roll this out.

The StatefulSet starts the resolver with -kube and no longer mounts the two
ConfigMaps; its service account loses the ConfigMap role and keeps only the
read-only Role on the fancy-dns objects (crds/rbac.yaml). The kustomization now
installs the definitions and that Role. The shipped config no longer lists the
migrated sources.

Config validation no longer refuses an enabled blocklist with no sources in the
file, because BlockList, DomainRule and AddressOverride objects can supply every
rule and the file cannot know. The existing "no source" warning says so. That
removed the only validation message the settings tests used as a fixture; they
now use an invalid acl.default_policy, and an empty settings document is refused
by the handler instead of by that check.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/k8s/10-deployment.yaml

@@ -27,7 +27,6 @@ spec:
       annotations:
         k8s-helper.io/git-url: "https://git.k6n.net/mats/fancy-dns"
         k8s-helper.io/git-ssh: "git@git.k6n.net:mats/fancy-dns.git"
-        dns.k6n.net/zones-api: "enabled"
         # A config change is a SIGHUP, not a restart: the server re-reads the
         # file and hot-swaps every component. This annotation is for
         # stakater/reloader-class controllers; without one, `kubectl rollout
@@ -66,6 +65,10 @@ spec:
           args:
             - -config
             - /etc/fancy-dns/config.yaml
+            # Read ClientGroup, BlockList, DNSZone, AddressOverride and
+            # DomainRule objects from this namespace with the pod's service
+            # account. The console (console/console.yaml) is what writes them.
+            - -kube
           env:
             # Substituted into the config by the loader, so the admin API key
             # comes from the Secret and not from the ConfigMap.
@@ -136,12 +139,6 @@ spec:
               mountPath: /etc/fancy-dns/config.yaml
               subPath: config.yaml
               readOnly: true
-            - name: zones
-              mountPath: /etc/fancy-dns/zones
-              readOnly: true
-            - name: rpz
-              mountPath: /etc/fancy-dns/rpz
-              readOnly: true
             - name: tls
               mountPath: /etc/fancy-dns/tls
               readOnly: true
@@ -153,17 +150,6 @@ spec:
         - name: config
           configMap:
             name: fancy-dns-config
-        # Local zones are ordinary master files. The API writes them to the
-        # shared ConfigMap, which projects one zone--<apex>.zone file per zone here.
-        # The GitOps manifest creates the ConfigMap empty; the UI owns its data.
-        - name: zones
-          configMap:
-            name: fancy-dns-zones
-            optional: false
-        - name: rpz
-          configMap:
-            name: fancy-dns-rpz
-            optional: false
         - name: tls
           secret:
             secretName: fancy-dns-tls