Add UI editing for local DNS zones

Local zones were only editable as mounted files, so operators could not manage DNS entries from the console. Add a Local zones editor backed by a shared Kubernetes ConfigMap, validate master files before saving, scope the pod service account to that ConfigMap, and reload changed zones on every replica while flushing stale cache entries.

deploy/k8s/05-serviceaccount.yaml

@@ -1,7 +1,6 @@
-# A stable identity for the pods. The server never talks to the Kubernetes API
-# (blocklist replication goes through Valkey, not the API server), so the token
-# is not just unused but actively undesirable: automounting it would hand every
-# pod a credential it has no reason to hold.
+# The UI edits the shared `fancy-dns-zones` ConfigMap. Its projected volume is
+# read-only; these narrowly scoped permissions let the API update only that
+# one ConfigMap so both DNS replicas receive the same records.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -9,4 +8,29 @@ metadata:
   namespace: dns
   labels:
     app.kubernetes.io/name: fancy-dns
-automountServiceAccountToken: false
+automountServiceAccountToken: true
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: fancy-dns-zones
+  namespace: dns
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["fancy-dns-zones"]
+    verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fancy-dns-zones
+  namespace: dns
+subjects:
+  - kind: ServiceAccount
+    name: fancy-dns
+    namespace: dns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: fancy-dns-zones