Add UI editing for local DNS zones

Local zones were only editable as mounted files, so operators could not manage DNS entries from the console. Add a Local zones editor backed by a shared Kubernetes ConfigMap, validate master files before saving, scope the pod service account to that ConfigMap, and reload changed zones on every replica while flushing stale cache entries.

internal/api/api.go

@@ -71,6 +71,10 @@ type Hooks struct {
 	AddDomain func(ctx context.Context, in DomainInput) (any, error)
 	// DeleteDomain removes a rule and persists the change.
 	DeleteDomain func(ctx context.Context, name, action, list string) error
+	// LocalZones lists, saves and deletes UI-managed DNS master files.
+	LocalZones      func(ctx context.Context) ([]ZoneFile, error)
+	SaveLocalZone   func(ctx context.Context, name, content string) error
+	DeleteLocalZone func(ctx context.Context, name string) error
 	// GetACL returns the ACL groups.
 	GetACL func() any
 	// PutACL validates and persists new ACL groups.
@@ -119,6 +123,12 @@ type DomainInput struct {
 	Content string `json:"content,omitempty"`
 }
 
+// ZoneFile is a UI-managed authoritative master file.
+type ZoneFile struct {
+	Name    string `json:"name"`
+	Content string `json:"content"`
+}
+
 // LogQuery pages the query log.
 type LogQuery struct {
 	Limit       int
@@ -259,6 +269,9 @@ func (s *Server) routes(cfg *config.Config) *http.ServeMux {
 	mux.Handle("POST "+base+"domains", s.authed(s.handleDomainAdd, true))
 	mux.Handle("DELETE "+base+"domains/{name...}", s.authed(s.handleDomainDelete, true))
 	mux.Handle("GET "+base+"domains/check", s.authed(s.handleDomainCheck, false))
+	mux.Handle("GET "+base+"local-zones", s.authed(s.handleLocalZones, false))
+	mux.Handle("PUT "+base+"local-zones/{name}", s.authed(s.handleLocalZonePut, true))
+	mux.Handle("DELETE "+base+"local-zones/{name}", s.authed(s.handleLocalZoneDelete, true))
 	mux.Handle("GET "+base+"clients", s.authed(s.handleClients, false))
 	mux.Handle("PUT "+base+"clients", s.authed(s.handleClientsPut, true))
 	mux.Handle("GET "+base+"upstreams", s.authed(s.handleUpstreams, false))