Support RPZ address overrides for local DNS

RPZ A records were parsed as address redirects, but the query pipeline treated the address as a CNAME target and returned the wrong result. Answer IP-literal redirects directly with the matching A or AAAA record, and return NODATA for other query types.

Add the requested EdgeRouter domain overrides as a local RPZ source so each bare owner covers its apex and all subdomains. Mount that source into the pods and document the address-record form. When the Zones page has no existing zone, start the Add Record form in New zone mode and tell the operator to enter its apex.

internal/engine/engine.go

@@ -1033,9 +1033,9 @@ func sinkhole(q *dns.Msg, cfg config.Block) *dns.Msg {
 	return m
 }
 
-// redirect answers with a CNAME to a configured name, plus an A/AAAA for the
-// target when we know it (a CNAME to a name that does not resolve would be a
-// worse answer than no CNAME at all).
+// redirect answers with the configured address when target is an IP literal.
+// Otherwise it answers with a CNAME to a configured name, plus an A/AAAA for
+// the target when available.
 func redirect(q *dns.Msg, target string, ttl uint32) *dns.Msg {
 	m := new(dns.Msg)
 	m.SetReply(q)
@@ -1046,6 +1046,27 @@ func redirect(q *dns.Msg, target string, ttl uint32) *dns.Msg {
 	if len(q.Question) == 0 {
 		return m
 	}
+	if addr, err := netip.ParseAddr(target); err == nil {
+		addr = addr.Unmap()
+		var rrType uint16
+		switch {
+		case addr.Is4() && q.Question[0].Qtype == dns.TypeA:
+			rrType = dns.TypeA
+		case addr.Is6() && q.Question[0].Qtype == dns.TypeAAAA:
+			rrType = dns.TypeAAAA
+		default:
+			m.Ns = []dns.RR{syntheticSOA(q, ttl)}
+			return m
+		}
+		rr, err := dns.NewRR(q.Question[0].Name + " 0 IN " + dns.TypeToString[rrType] + " " + addr.String())
+		if err == nil {
+			rr.Header().Ttl = ttl
+			m.Answer = []dns.RR{rr}
+		} else {
+			m.Ns = []dns.RR{syntheticSOA(q, ttl)}
+		}
+		return m
+	}
 	cname, err := dns.NewRR(q.Question[0].Name + " 0 IN CNAME " + dns.Fqdn(target))
 	if err != nil {
 		return m