fix: address code review findings for DNS management

- CRITICAL: Change DNS zones endpoint from GET to POST to avoid
  leaking API token in URL query parameters
- HIGH: Add sync.RWMutex to protect dnsProvider field in Server,
  Deployer, and proxy Manager against concurrent read/write races
- HIGH: Capture old DNS provider reference synchronously before
  launching background cleanup goroutine
- HIGH: Use getDNS()/getDNSProviderLocked() accessors instead of
  direct field reads in all DNS operations

CLAUDE.md

@@ -0,0 +1,10 @@
+# Docker Watcher
+
+## Dev Server
+
+Start/restart with: `./scripts/dev-server.sh`
+
+- Runs on port **8090** (avoids 8080 conflict with other local services)
+- Auto-generates `ENCRYPTION_KEY` if not set
+- Default login: `admin` / `admin123`
+- Override port: `LISTEN_ADDR=:9000 ./scripts/dev-server.sh`