feat: add allowed_record_types and enforce append_only as superset check

[teunis90]

New zone-level config options

allowed_record_types (list[str])

Restricts which DNS record types a token may write in a zone. An empty list (the default) means all types are permitted.

append_only (bool)

Prevents any write from removing existing records:

• DELETE changesets are rejected with HTTP 403.
• REPLACE changesets are verified against the live PowerDNS state. The incoming records must be a strict superset of what is currently in PowerDNS for that name+type. Any record missing from the payload results in a 403.

Both flags can be combined. Example — a token that may only ever add TXT records globally and can never remove any:

- name: "append-txt-only"
  token_sha512: "..."
  global_read_only: true
  zones:
    - name: ".*"
      regex: true
      allowed_record_types:
        - "TXT"
      append_only: true

Why changetype: REPLACE needed extra protection

PowerDNS's REPLACE changetype overwrites the entire RRset for a given name+type. Without this check, a client could silently drop existing records by sending a REPLACE with a subset of the current records — even with append_only: true. The proxy now fetches the current zone state before forwarding any REPLACE on an append_only zone and rejects the request if records would be lost.

Implementation

Location	Responsibility
models.py	Added allowed_record_types and append_only fields to ProxyConfigZone
config.py — check_rrset_allowed()	Blocks DELETE when append_only; blocks wrong types when allowed_record_types is set
config.py — check_append_only_records_intact()	Pure helper: compares existing vs incoming record contents, returns False if any would be removed
config.py — ensure_rrsets_request_allowed()	Gains optional existing_rrsets param; calls the superset check for REPLACE on append_only zones
proxy.py — update_zone_rrset()	Fetches current zone from PowerDNS when zone.append_only, passes rrsets to ensure_rrsets_request_allowed

All policy logic stays in config.py and is fully unit-testable without mocking HTTP. proxy.py only does the I/O fetch.

Tests

20 new unit tests covering:

• allowed_record_types: allowed type, mismatched type, multiple types, no restriction
• append_only: REPLACE allowed, DELETE blocked, DELETE allowed without flag
• Combined allowed_record_types + append_only: TXT REPLACE allowed, TXT DELETE blocked, wrong type blocked
• check_append_only_records_intact: no existing RRset, exact same records, superset, drops a record, different type, different name
• ensure_rrsets_request_allowed with existing_rrsets: superset passes, drop blocked with 403