Add AddressOverride and DomainRule objects for what lived in a ConfigMap and the config file

The address redirects page rewrote an RPZ ConfigMap through the resolver's own
service account, and the domains page rewrote allow_entries/block_entries in the
config file. Both become cluster objects like the rest.

AddressOverride is one name answered with fixed addresses (the name and
everything under it), exactly what an RPZ "name A address" line did. DomainRule
is a block or allow list of inline names. The resolver reads both with the
existing watch: overrides are rendered into the managed RPZ source the blocklist
manager already has, and rule names join the config's inline entries in the
merged overlay, so the file's config is never written to.

Names are checked to be DNS names or wildcard patterns before they are used,
because they are joined into line-oriented parser input and a newline or a
comment character in one would otherwise add a rule of its own.

The console edits both: the address-overrides and domains endpoints now write
objects. The console keeps its added rules in one DomainRule per action
(inline-block, inline-allow) instead of an object per name, and removes a name
from whichever DomainRule holds it, wildcard or not. An end-to-end test drives
the pages' endpoints and checks the resolver's answers.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/console/console.go

@@ -88,6 +88,11 @@ func (c *Console) Handler() (http.Handler, error) {
 		"DELETE " + base + "/zones/delegations",
 		"DELETE " + base + "/zones",
 		"POST " + base + "/blocklists/toggle",
+		"GET " + base + "/address-overrides",
+		"PUT " + base + "/address-overrides",
+		"DELETE " + base + "/address-overrides/{domain}",
+		"POST " + base + "/domains",
+		"DELETE " + base + "/domains/{name...}",
 	} {
 		mux.Handle(p, own)
 	}

internal/console/hooks.go

@@ -32,6 +32,12 @@ func (c *Console) hooks() api.Hooks {
 		AddZoneDelegation:    c.addZoneDelegation,
 		DeleteZoneDelegation: c.deleteZoneDelegation,
 		DeleteZone:           c.deleteZone,
+
+		AddressOverrides:      c.listOverrides,
+		SaveAddressOverride:   c.saveOverride,
+		DeleteAddressOverride: c.deleteOverride,
+		AddDomain:             c.addDomain,
+		DeleteDomain:          c.deleteDomain,
 	}
 }
 
@@ -274,3 +280,68 @@ func (c *Console) handleListSourceDelete(w http.ResponseWriter, r *http.Request)
 	}
 	api.WriteJSON(w, http.StatusOK, map[string]any{"ok": true, "name": name})
 }
+
+// addressOverride is one row of the Address redirects page.
+type addressOverride struct {
+	Domain  string `json:"domain"`
+	Address string `json:"address"`
+}
+
+func (c *Console) listOverrides(ctx context.Context) (any, error) {
+	objs, err := c.opt.Editor.Overrides(ctx)
+	if err != nil {
+		return nil, err
+	}
+	items := []addressOverride{}
+	for _, o := range objs {
+		for _, a := range o.Addresses {
+			items = append(items, addressOverride{Domain: o.Domain, Address: a})
+		}
+	}
+	return map[string]any{"items": items, "writable": true, "initialized": true}, nil
+}
+
+func (c *Console) saveOverride(ctx context.Context, domain, address string) error {
+	return c.opt.Editor.SetOverride(ctx, domain, address, actor(ctx))
+}
+
+func (c *Console) deleteOverride(ctx context.Context, domain string) error {
+	return c.opt.Editor.DeleteOverride(ctx, domain)
+}
+
+// addDomain adds inline block or allow rules. A bulk paste arrives as content,
+// one name per line.
+func (c *Console) addDomain(ctx context.Context, in api.DomainInput) (any, error) {
+	action := strings.ToLower(strings.TrimSpace(in.Action))
+	if action != "block" && action != "allow" {
+		return nil, fmt.Errorf("inline rules can block or allow a name; %q is not one of those (use an AddressOverride to answer with an address)", in.Action)
+	}
+	raw := []string{in.Name}
+	if in.Content != "" {
+		raw = strings.Split(in.Content, "\n")
+	}
+	var names []string
+	for _, line := range raw {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		names = append(names, line)
+	}
+	if len(names) == 0 {
+		return nil, errors.New("name is required")
+	}
+	n, err := c.opt.Editor.AddRules(ctx, action, names, actor(ctx))
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{"ok": true, "name": strings.TrimSpace(in.Name), "count": n}, nil
+}
+
+func (c *Console) deleteDomain(ctx context.Context, name, _, list string) error {
+	_, err := c.opt.Editor.DeleteRule(ctx, name, actor(ctx))
+	if errors.Is(err, kubeedit.ErrNotFound) && list != "" {
+		return fmt.Errorf("%q comes from the list %q; edit that list instead", name, list)
+	}
+	return err
+}