feat: Cloudflare DNS management with automatic record sync

Add flexible DNS management to Docker Watcher. By default, wildcard DNS
is assumed (current behavior). When disabled, users can configure a
Cloudflare DNS provider with API token and zone selection. DNS A records
are automatically created/updated/deleted in sync with proxy consumers
(deployed instances and standalone proxies).

- Settings: wildcard_dns toggle, dns_provider, cloudflare credentials
- Cloudflare client: Provider interface with EnsureRecord/DeleteRecord/ListRecords
- DNS lifecycle hooks in deployer and proxy manager (best-effort)
- Settings UI: DNS config section with provider picker, zone selector, test button
- DNS Records page at /dns with filtering, sync status, reconciliation
- Records visible in both wildcard and managed modes
- Cleanup on provider change: removes old records when switching modes

internal/dns/dns.go

@@ -0,0 +1,22 @@
+package dns
+
+import "fmt"
+
+// Config holds configuration for creating a DNS provider.
+type Config struct {
+	Token  string
+	ZoneID string
+}
+
+// NewProvider creates a DNS provider by name.
+// Returns nil, nil when providerName is empty (wildcard DNS mode).
+func NewProvider(providerName string, cfg Config) (Provider, error) {
+	switch providerName {
+	case "":
+		return nil, nil
+	case "cloudflare":
+		return NewCloudflare(cfg.Token, cfg.ZoneID)
+	default:
+		return nil, fmt.Errorf("unsupported DNS provider: %s", providerName)
+	}
+}