Add UI editing for local DNS zones

Local zones were only editable as mounted files, so operators could not manage DNS entries from the console. Add a Local zones editor backed by a shared Kubernetes ConfigMap, validate master files before saving, scope the pod service account to that ConfigMap, and reload changed zones on every replica while flushing stale cache entries.

internal/api/handlers.go

@@ -177,6 +177,52 @@ func (s *Server) handleDomainCheck(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, v)
 }
 
+func (s *Server) handleLocalZones(w http.ResponseWriter, r *http.Request) {
+	if s.hooks.LocalZones == nil {
+		writeError(w, http.StatusNotImplemented, "local zone editor is unavailable")
+		return
+	}
+	zones, err := s.hooks.LocalZones(r.Context())
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"zones": zones})
+}
+
+func (s *Server) handleLocalZonePut(w http.ResponseWriter, r *http.Request) {
+	if s.hooks.SaveLocalZone == nil {
+		writeError(w, http.StatusNotImplemented, "local zone editor is unavailable")
+		return
+	}
+	var in struct {
+		Content string `json:"content"`
+	}
+	if err := decodeJSON(r, &in); err != nil {
+		writeError(w, http.StatusBadRequest, "malformed request body")
+		return
+	}
+	name := r.PathValue("name")
+	if err := s.hooks.SaveLocalZone(r.Context(), name, in.Content); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "name": name})
+}
+
+func (s *Server) handleLocalZoneDelete(w http.ResponseWriter, r *http.Request) {
+	if s.hooks.DeleteLocalZone == nil {
+		writeError(w, http.StatusNotImplemented, "local zone editor is unavailable")
+		return
+	}
+	name := r.PathValue("name")
+	if err := s.hooks.DeleteLocalZone(r.Context(), name); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "name": name})
+}
+
 // handleDomainAdd adds an inline rule.
 func (s *Server) handleDomainAdd(w http.ResponseWriter, r *http.Request) {
 	if s.hooks.AddDomain == nil {