Remove the ConfigMap, RPZ and managed-directory editors the cluster objects replace

Zones, address redirects, inline rules, lists and groups are cluster objects now
(see the previous commits and deploy/MIGRATION.md), so the mechanisms that held
them are gone:

* internal/kubezones and the resolver's service-account access to a ConfigMap,
  the address-overrides read/write path and its poller, the zone-file poller and
  the Local zones editor with its /api/local-zones routes.
* localzone.Managed, the directory of console-written master files, and the
  blocklist.managed_zones key. The resolver now writes no zone data at all; its
  zone hooks only list. The shared half of that file (the record validator, the
  renderer and the round-trip check) stays as zonestate.go, because DNSZone
  rendering is built on it. Its tests are ported to RenderZone, which keeps the
  coverage of every editable record type, wildcards, relative owners, the
  SOA/NS rule and the delegation rule.
* Tests of the removed write paths: the contract test now builds its zone from a
  DNSZone, and a new test pins that every zone write route on the resolver is
  refused and changes nothing.

Standalone installs keep editing master files on disk and SIGHUP, and the
YAML-backed domain, client, upstream and settings editors, which have not moved.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/app/app.go

@@ -29,7 +29,6 @@ import (
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/config"
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/engine"
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/kubesource"
-	"git.k8s-git-k6n.net/mats/fancy-dns/internal/kubezones"
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/localzone"
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/metrics"
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/resolver"
@@ -63,29 +62,22 @@ type App struct {
 	cfg *config.Store
 	ver string
 
-	blocks     *blocklist.Manager
-	overrideMu sync.Mutex
-	cache      *cache.Manager
-	cstore     *cache.Store
-	logger     *accesslog.Logger
-	aclH       *acl.Holder
-	local      *localzone.Holder
-	// zones is the Kubernetes-sourced zone client.
-	zones *kubezones.Client
+	blocks *blocklist.Manager
+	cache  *cache.Manager
+	cstore *cache.Store
+	logger *accesslog.Logger
+	aclH   *acl.Holder
+	local  *localzone.Holder
 	// kube watches the cluster's fancy-dns objects when enabled; kubeSnap is
 	// what the config overlay merges in.
 	kube     *kubesource.Source
 	kubeSnap atomic.Pointer[kubesource.Snapshot]
-	// managedZones is the console-managed zone directory: the only zone data
-	// the admin API may rewrite. An empty directory is what makes the
-	// console's Zones page read-only.
-	managedZones *localzone.Managed
-	pool         *resolver.Pool
-	reverse      *engine.ReverseCache
-	engine       *engine.Engine
-	dns          *server.Server
-	api          *api.Server
-	cl           *cluster.Cluster
+	pool     *resolver.Pool
+	reverse  *engine.ReverseCache
+	engine   *engine.Engine
+	dns      *server.Server
+	api      *api.Server
+	cl       *cluster.Cluster
 
 	apiServers []*http.Server
 	apiLn      []net.Listener
@@ -116,11 +108,7 @@ func New(opt Options) (*App, error) {
 		return nil, err
 	}
 	store := config.NewStore(cfg, opt.ConfigPath)
-	zones, err := kubezones.InCluster()
-	if err != nil {
-		return nil, err
-	}
-	return &App{opt: opt, log: log, cfg: store, ver: opt.Version, zones: zones}, nil
+	return &App{opt: opt, log: log, cfg: store, ver: opt.Version}, nil
 }
 
 // newLogger builds the structured logger from config plus CLI overrides.
@@ -322,22 +310,9 @@ func (a *App) startBlocklist() {
 		Config: a.cfg,
 		Logger: a.log,
 	})
-	if a.zones != nil {
-		ctx := context.Background()
-		content, exists, err := a.zones.Data(ctx, "address-overrides.rpz")
-		if err == nil && !exists {
-			if seed, readErr := os.ReadFile("/etc/fancy-dns/rpz/address-overrides.rpz"); readErr == nil {
-				content = string(seed)
-				if saveErr := a.zones.SaveData(ctx, "address-overrides.rpz", content); saveErr != nil {
-					a.log.Warn("seed address overrides failed", "error", saveErr)
-				}
-			}
-		}
-		if err == nil {
-			a.blocks.SetManagedRPZ(content)
-		} else {
-			a.log.Warn("load address overrides failed", "error", err)
-		}
+	// The cluster's address overrides, if the Kubernetes source has any yet.
+	if snap := a.kubeSnap.Load(); snap != nil {
+		a.blocks.SetManagedRPZ(kubesource.RenderRPZ(snap.Overrides))
 	}
 	// Compile once before serving so the first queries are not unprotected.
 	if _, err := a.blocks.RefreshAll(context.Background()); err != nil {
@@ -349,14 +324,9 @@ func (a *App) startBlocklist() {
 // startLocalZones compiles the local master files.
 func (a *App) startLocalZones(cfg *config.Config) {
 	a.local = localzone.NewHolder(nil)
-	a.managedZones = localzone.NewManaged(cfg.AbsPath(cfg.Block.ManagedZones))
 	a.reloadLocalZones()
 }
 
-// managedZoneDir is the directory the console may write zone files into, or
-// "" when the console is read-only.
-func (a *App) managedZoneDir() string { return a.managedZones.Dir() }
-
 // reloadLocalZones recompiles the local zone store. A failure keeps the
 // previous store: serving stale local data beats serving nothing.
 func (a *App) reloadLocalZones() {
@@ -367,13 +337,8 @@ func (a *App) reloadLocalZones() {
 	for _, p := range cfg.Block.LocalZones {
 		paths = append(paths, cfg.AbsPath(p))
 	}
-	// The managed directory is a zone source like any other, so a zone the
-	// console created is served by the same store. It is only added when it
-	// exists: the loader stats every path it is given, and a directory the
-	// console has not written to yet is not a broken configuration.
-	if a.managedZones.Exists() {
-		paths = append(paths, a.managedZones.Dir())
-	}
+	// DNSZone objects are rendered into a directory of their own, which is a
+	// zone source like any other.
 	if dir := a.kubeZoneDir(); dir != "" {
 		paths = append(paths, dir)
 	}
@@ -600,8 +565,6 @@ func (a *App) startCluster(ctx context.Context, cfg *config.Config) {
 // startBackground runs the periodic jobs: cache snapshots, upstream health
 // probes and the metrics gauge.
 func (a *App) startBackground(ctx context.Context, cfg *config.Config) {
-	go a.watchLocalZones(ctx)
-	go a.watchAddressOverrides(ctx)
 	// Cache snapshots.
 	if a.cstore != nil {
 		interval := cfg.Cache.Persist.Interval.D()