fix(dns): make the Cloudflare DNS provider boot, validate, and delete safely (#37)

[Hydralerne]

Supersedes #528, keeping its commit so @thisisrakshith's work stays attributed. Resolves #37.

The first commit is #528 unchanged. The second is the fix pass — reviewing that commit on its own shows exactly what changed and why.

Why this wasn't mergeable as-is

Three independent problems, each verified by running the branch rather than reading it:

1. The control plane didn't start. packages/db/src/repos/index.ts:322 used createDnsCredentialRepo, but the symbol was only added to an export { … } from block — a re-export creates no local binding. Importing @repo/db threw ReferenceError, so nothing that touches the DB booted.
2. Both write endpoints rejected every request. secureRouter feeds body to TypeBox's tbValidator; the schemas were Zod. A fully valid POST /api/dns/credentials returned 500 (ValueCheckUnknownTypeError). Separately, org:read/org:admin are not valid tags — org isn't a root resource, so parsePermissionTag threw at route registration, a second boot failure.
3. Removing a domain could delete DNS you own. Cleanup listed records by name only and deleted everything returned. For an apex domain the record name is the zone apex, where your MX, SPF TXT and CAA live — so removing a domain from Openship could take the org's mail with it.

There was also no SQL migration for dns_credential (runtime DDL here is journal-driven only, so every endpoint would 500 on relation does not exist), and the ../dns barrel re-exported dns.routes, which meant importing a service mounted the HTTP route table — that alone broke 83 test files.

What changed

Boot + validation — added the missing import; added 0098_dns_credential.sql and its journal entry (hand-written, matching every migration since 0061; verified against PGlite: 9 columns, 3 indexes, FK CASCADE); ported the schemas to TypeBox with bounded name/apiToken/hostname; moved to settings:read/settings:admin; fixed buildBackgroundContext, which was called with two positional args instead of one options object; stopped the barrel leaking routes into services; and gave addDomain an explicit return type — adding a field to one of its two returns had silently dropped preexistingEdgeSite from the other, breaking the edge-takeover notice.

Record safety — deletion is gated on a Managed by Openship provider-side comment, so we only ever remove records we wrote. Cleanup moved above the service-scoped early return it was sitting below, so per-service domains stop leaking records. upsertRecord preserves your Cloudflare proxying instead of resetting it, compares against the effective TTL, and returns 409 rather than half-rewriting a round-robin A set it doesn't own.

Honest failure modes — findZone propagates 429/5xx instead of reporting "no zone", and the lookup answers matched | none | unauthorized | unavailable, so "we couldn't ask" stops reading as "this domain isn't yours". provisionRecords attempts every record and reports per-record outcomes, so a partial write isn't indistinguishable from nothing happening. The t=0 verify is gone: the row stays pending for the existing domains:verify-pending sweep instead of burning a Let's Encrypt validation failure on records that haven't propagated. listRecords paginates; the zone walk is bounded.

Secrets + audit — no read path decrypts. tokenMasked is the constant ENV_MASK, never a token prefix, and a rotated BETTER_AUTH_SECRET surfaces as status: "invalid" instead of 500ing the list. Added dns_credential.connected/.disconnected audit events carrying the label and provider only.

Surface — added the Settings → DNS tab (connect, remove, masked status, zone check) with strings in all nine locales (parity ratchet stays green), 54 DNS tests in place of the original 12, and docs/api/dns.mdx registered in meta.json since every other API module has a page.

Deliberately out of scope

The tunnel rewrite and the DNS-01 / wildcard certbot plumbing are reverted byte-identical to main. Both were unreachable rather than incomplete: nothing anywhere passed challenge/dnsAuthHook, and assertValidDomain rejects a *. name before that branch can run; the tunnel provider's preflight returned ok: true without probing for cloudflared, discarded the token its named-tunnel path needed, and emitted error on an EventEmitter with no listener attached. Each deserves its own PR now that the provider abstraction exists to build on.

Verification

	before	after
apps/api typecheck	7 errors	clean
apps/dashboard typecheck	clean	clean
full monorepo tests	84 files failed, ~714 tests never ran	7/7 tasks, 5308 tests, 0 failures
API boots	ReferenceError on import	boots
POST /api/dns/credentials	500 on every request	works

origin/main was confirmed green at the same commit first, so the before/after numbers are attributable to the branch and not the environment.

Before merging

origin/main is at 0097, so the migration is 0098. If another migration lands first, this needs renumbering.