feat: separate Public IP for DNS records from Server IP, improve settings help texts

- Add public_ip field to Settings for DNS A records (proxy/load balancer IP)
- DNS records now use public_ip, falling back to server_ip if empty
- Server IP renamed to "Server IP (Docker Host)" for clarity
- Public IP labeled "Public IP (DNS Target)"
- Updated help texts for domain, server IP, public IP, and Docker network
- DB migration + schema for public_ip column

internal/api/dns.go

@@ -12,6 +12,15 @@ import (
 	"github.com/go-chi/chi/v5"
 )
 
+// dnsTargetIP returns the IP to use for DNS A records.
+// Prefers PublicIP (the proxy/NPM host), falls back to ServerIP.
+func dnsTargetIP(settings store.Settings) string {
+	if settings.PublicIP != "" {
+		return settings.PublicIP
+	}
+	return dnsTargetIP(settings)
+}
+
 // dnsRecordView is the response format for DNS records with consumer context.
 type dnsRecordView struct {
 	FQDN         string `json:"fqdn"`
@@ -56,7 +65,7 @@ func (s *Server) listDNSRecords(w http.ResponseWriter, r *http.Request) {
 			views = append(views, dnsRecordView{
 				FQDN:         fqdn,
 				Type:         "A",
-				Content:      settings.ServerIP,
+				Content:      dnsTargetIP(settings),
 				ConsumerType: consumerType,
 				ConsumerName: name,
 				ConsumerID:   consumerID,
@@ -107,7 +116,7 @@ func (s *Server) listDNSRecords(w http.ResponseWriter, r *http.Request) {
 	// Process local records: check if they exist in provider.
 	for _, local := range localRecords {
 		status := "missing"
-		content := settings.ServerIP
+		content := dnsTargetIP(settings)
 		if pRec, ok := providerByFQDN[local.FQDN]; ok {
 			status = "synced"
 			content = pRec.Content
@@ -292,7 +301,7 @@ func (s *Server) syncDNSRecords(w http.ResponseWriter, r *http.Request) {
 			continue
 		}
 
-		recordID, err := provider.EnsureRecord(r.Context(), fqdn, settings.ServerIP)
+		recordID, err := provider.EnsureRecord(r.Context(), fqdn, dnsTargetIP(settings))
 		if err != nil {
 			slog.Warn("dns sync: failed to create record", "fqdn", fqdn, "error", err)
 			continue