feat: List each hostname's DNS records on the load balancer

[scotwells]

Summary

People adding a custom hostname have no single place to see which DNS records it still needs, so the portal and the CLI piece it together from condition messages and the Domain.

Each hostname on a load balancer now lists the records it depends on, who publishes each, and whether each is in place, so the portal and the CLI can read that list alone.

A record counts as present only once it takes effect on the Internet, never because it sits in a Datum DNS zone the registry does not delegate to.

All of it sits behind the certificate service setting, off by default, and this is stacked on #526.

API

New status only. The spec does not change.

status:
  canonicalHostname: ruth-fourth-hrkgk.datumproxy.net
  hostnameStatuses:
    - hostname: "*.s3.example.com"
      conditions:             # unchanged
        - type: Available
          status: "True"
      dnsRecords:
        - name: "*.s3.example.com"
          type: CNAME         # CNAME, ALIAS (apex flattening) or TXT
          content: ruth-fourth-hrkgk.datumproxy.net
          purpose: Routing    # Routing, Certificate or Ownership
          managedBy: User     # User or Platform
          state: Missing      # Present or Missing
        - name: _acme-challenge.s3.example.com
          type: CNAME
          content: k3f9q2x7.acme-dns.example.net
          purpose: Certificate
          managedBy: User
          state: Present
        - name: datum-custom-hostname.example.com
          type: TXT
          content: 4f1c2a9e-6f0b-4d6e-9d55-0b7d1c1f6a3e
          purpose: Ownership
          managedBy: User
          state: Missing

When each record appears and when it counts as present:

Purpose	Listed when	Present when
Routing	always, for every custom hostname	a platform record is programmed in the Datum DNS zone the registry delegates to, or public DNS resolves a user record to the canonical hostname or its addresses
Certificate	the hostname is a wildcard, the only kind the certificate service issues, over DNS	the certificate service reports the challenge delegation resolves
Ownership	no verified Domain covers the hostname yet	never, since the record drops off once the Domain verifies

A record shared by several hostnames, such as the ownership TXT, appears under each hostname that needs it. Readers should list it once.

Only the operator writes status. Records the certificate service names for any other hostname are ignored, so a forged certificate status cannot steer a user to publish someone else's record.

The operator checks public DNS for user routing records at most once a minute per hostname, and looks again every five minutes while one is missing. No printer columns, conditions or validation rules change.

Test plan

• Unit tests cover each record kind, including a forged certificate record, a zone the registry does not delegate to, and an apex hostname
• With the setting off, load balancer status is unchanged
• Build, vet, lint and the full suite pass locally and in CI
• On staging, a hostname's routing record turns Present within five minutes of publishing it

Related to datum-cloud/enhancements#913