feat: Cloudflare DNS management with automatic record sync

Add flexible DNS management to Docker Watcher. By default, wildcard DNS
is assumed (current behavior). When disabled, users can configure a
Cloudflare DNS provider with API token and zone selection. DNS A records
are automatically created/updated/deleted in sync with proxy consumers
(deployed instances and standalone proxies).

- Settings: wildcard_dns toggle, dns_provider, cloudflare credentials
- Cloudflare client: Provider interface with EnsureRecord/DeleteRecord/ListRecords
- DNS lifecycle hooks in deployer and proxy manager (best-effort)
- Settings UI: DNS config section with provider picker, zone selector, test button
- DNS Records page at /dns with filtering, sync status, reconciliation
- Records visible in both wildcard and managed modes
- Cleanup on provider change: removes old records when switching modes

plans/cloudflare-dns-management/phase-4-settings-ui.md

@@ -0,0 +1,55 @@
+# Phase 4: Settings UI — DNS Configuration
+
+**Status:** ⬜ Not Started
+**Parent plan:** [PLAN.md](./PLAN.md)
+**Domain:** frontend
+
+## Objective
+Add a "DNS Configuration" section to the Settings page with wildcard toggle, provider
+selection, Cloudflare credential fields, and connection test.
+
+## Tasks
+
+- [ ] Task 1: Add new API functions in `web/src/lib/api.ts`
+  - `testDnsConnection(token, zoneId)` → POST /api/settings/dns/test
+  - `listDnsZones(token)` → GET /api/settings/dns/zones
+- [ ] Task 2: Add i18n keys for DNS settings in locale files
+- [ ] Task 3: Add DNS Configuration section to `web/src/routes/settings/+page.svelte`
+  - Toggle: "Wildcard DNS is configured" (checkbox/switch)
+  - When unchecked, show:
+    - DNS Provider dropdown (only "Cloudflare" option)
+    - API Token field (password type, show `has_cloudflare_api_token` indicator)
+    - Zone picker (loaded from API after token provided)
+    - "Test Connection" button with success/error feedback
+  - All DNS fields hidden when wildcard is checked
+- [ ] Task 4: Wire save logic — include new fields in `handleSave`
+- [ ] Task 5: Wire load logic — populate DNS fields from settings response
+
+## Files to Modify/Create
+- `web/src/lib/api.ts` — add DNS API functions
+- `web/src/routes/settings/+page.svelte` — add DNS config section
+- `web/src/lib/i18n/en.ts` (or equivalent locale file) — add DNS translation keys
+
+## Acceptance Criteria
+- Wildcard toggle visible and functional (default: checked)
+- Unchecking reveals Cloudflare configuration form
+- API token field uses password masking
+- Zone picker loads zones from Cloudflare API
+- Test Connection button shows success/failure
+- Settings save includes DNS fields
+- Settings load populates DNS fields
+
+## Notes
+- Follow existing settings page patterns (FormField, EntityPicker for zones)
+- Zone picker similar to SSL certificate picker pattern
+- Token field similar to NPM password field (has_token indicator)
+
+## Review Checklist
+- [ ] All tasks completed
+- [ ] Code follows project conventions
+- [ ] No unintended side effects
+- [ ] Build passes
+- [ ] Tests pass (new + existing)
+
+## Handoff to Next Phase
+<!-- Filled in after completion -->