fix: address final review findings

- CRITICAL: Add binaries and .svelte-kit/ to .gitignore, remove from tracking
- HIGH: Return error from computeExpectedFQDNs to prevent mass DNS
  deletion on transient DB errors during sync
- MEDIUM: Log error in rollback DNS cleanup when GetSettings fails

internal/api/dns.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"fmt"
 	"log/slog"
 	"net/http"
 	"strings"
@@ -36,7 +37,11 @@ func (s *Server) listDNSRecords(w http.ResponseWriter, r *http.Request) {
 
 	// In wildcard mode, show expected records from consumers without sync status.
 	if settings.WildcardDNS {
-		expectedFQDNs := s.computeExpectedFQDNs(settings)
+		expectedFQDNs, err := s.computeExpectedFQDNs(settings)
+		if err != nil {
+			respondError(w, http.StatusInternalServerError, "failed to compute expected records: "+err.Error())
+			return
+		}
 		var views []dnsRecordView
 		for fqdn, consumer := range expectedFQDNs {
 			parts := strings.SplitN(consumer, ":", 2)
@@ -253,7 +258,11 @@ func (s *Server) syncDNSRecords(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Compute expected FQDNs from active consumers.
-	expectedFQDNs := s.computeExpectedFQDNs(settings)
+	expectedFQDNs, err := s.computeExpectedFQDNs(settings)
+	if err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to compute expected records: "+err.Error())
+		return
+	}
 
 	// Get actual provider records.
 	providerRecords, err := provider.ListRecords(r.Context())
@@ -332,18 +341,29 @@ func (s *Server) syncDNSRecords(w http.ResponseWriter, r *http.Request) {
 }
 
 // computeExpectedFQDNs returns a map of FQDN -> "consumerType:consumerID" for all active DNS consumers.
-func (s *Server) computeExpectedFQDNs(settings store.Settings) map[string]string {
+func (s *Server) computeExpectedFQDNs(settings store.Settings) (map[string]string, error) {
 	expected := make(map[string]string)
 
 	// Instances with proxy enabled.
-	projects, _ := s.store.GetAllProjects()
+	projects, err := s.store.GetAllProjects()
+	if err != nil {
+		return nil, fmt.Errorf("get projects: %w", err)
+	}
 	for _, p := range projects {
-		stages, _ := s.store.GetStagesByProjectID(p.ID)
+		stages, err := s.store.GetStagesByProjectID(p.ID)
+		if err != nil {
+			slog.Warn("dns: failed to get stages", "project_id", p.ID, "error", err)
+			continue
+		}
 		for _, st := range stages {
 			if !st.EnableProxy {
 				continue
 			}
-			instances, _ := s.store.GetInstancesByStageID(st.ID)
+			instances, err := s.store.GetInstancesByStageID(st.ID)
+			if err != nil {
+				slog.Warn("dns: failed to get instances", "stage_id", st.ID, "error", err)
+				continue
+			}
 			for _, inst := range instances {
 				if inst.NpmProxyID > 0 && inst.Subdomain != "" && inst.Status == "running" {
 					fqdn := inst.Subdomain + "." + settings.Domain
@@ -361,5 +381,5 @@ func (s *Server) computeExpectedFQDNs(settings store.Settings) map[string]string
 		}
 	}
 
-	return expected
+	return expected, nil
 }

internal/deployer/rollback.go

@@ -46,8 +46,10 @@ func (d *Deployer) rollback(ctx context.Context, deployID string, containerID st
 	if instanceID != "" {
 		inst, err := d.store.GetInstanceByID(instanceID)
 		if err == nil && inst.Subdomain != "" {
-			settings, _ := d.store.GetSettings()
-			if settings.Domain != "" {
+			settings, settingsErr := d.store.GetSettings()
+			if settingsErr != nil {
+				slog.Warn("rollback: failed to get settings for DNS cleanup", "error", settingsErr)
+			} else if settings.Domain != "" {
 				fqdn := inst.Subdomain + "." + settings.Domain
 				d.removeDNS(ctx, fqdn, deployID)
 			}