feat: Cloudflare DNS management with automatic record sync

Add flexible DNS management to Docker Watcher. By default, wildcard DNS
is assumed (current behavior). When disabled, users can configure a
Cloudflare DNS provider with API token and zone selection. DNS A records
are automatically created/updated/deleted in sync with proxy consumers
(deployed instances and standalone proxies).

- Settings: wildcard_dns toggle, dns_provider, cloudflare credentials
- Cloudflare client: Provider interface with EnsureRecord/DeleteRecord/ListRecords
- DNS lifecycle hooks in deployer and proxy manager (best-effort)
- Settings UI: DNS config section with provider picker, zone selector, test button
- DNS Records page at /dns with filtering, sync status, reconciliation
- Records visible in both wildcard and managed modes
- Cleanup on provider change: removes old records when switching modes

internal/store/models.go

@@ -58,9 +58,24 @@ type Settings struct {
 	SSLCertificateID   int    `json:"ssl_certificate_id"`
 	StaleThresholdDays int    `json:"stale_threshold_days"`
 	AllowedVolumePaths string `json:"allowed_volume_paths"` // JSON array of allowed absolute paths
+	WildcardDNS        bool   `json:"wildcard_dns"`
+	DNSProvider        string `json:"dns_provider"`
+	CloudflareAPIToken string `json:"cloudflare_api_token"`
+	CloudflareZoneID   string `json:"cloudflare_zone_id"`
 	UpdatedAt          string `json:"updated_at"`
 }
 
+// DNSRecord tracks a DNS record managed by the application.
+type DNSRecord struct {
+	ID               string `json:"id"`
+	FQDN             string `json:"fqdn"`
+	ProviderRecordID string `json:"provider_record_id"`
+	ConsumerType     string `json:"consumer_type"` // "instance" or "standalone"
+	ConsumerID       string `json:"consumer_id"`
+	CreatedAt        string `json:"created_at"`
+	UpdatedAt        string `json:"updated_at"`
+}
+
 // Instance represents a running (or stopped) container for a project stage.
 type Instance struct {
 	ID          string `json:"id"`