fix: address code review findings for DNS management

- CRITICAL: Change DNS zones endpoint from GET to POST to avoid
  leaking API token in URL query parameters
- HIGH: Add sync.RWMutex to protect dnsProvider field in Server,
  Deployer, and proxy Manager against concurrent read/write races
- HIGH: Capture old DNS provider reference synchronously before
  launching background cleanup goroutine
- HIGH: Use getDNS()/getDNSProviderLocked() accessors instead of
  direct field reads in all DNS operations

web/src/lib/api.ts

@@ -277,8 +277,7 @@ export function testDnsConnection(provider: string, token: string, zoneId: strin
 }
 
 export function listDnsZones(token?: string): Promise<DnsZone[]> {
-	const params = token ? `?token=${encodeURIComponent(token)}` : '';
-	return get<DnsZone[]>(`/api/settings/dns/zones${params}`);
+	return post<DnsZone[]>('/api/settings/dns/zones', { token: token ?? '' });
 }
 
 export function getDnsRecords(): Promise<DnsRecordView[]> {