feat(dns-cluster): replicate Technitium production to netinfra pair

Set up a fully scripted, documented Technitium DNS cluster that
replicates the production instance from tailscale-router to
pfv-netinfra-01 (primary) and pfv-netinfra-02 (secondary).

What it does:
- EXPORT: reads the production Technitium config (auth.config with
  users + 2FA, dns.config, all 124 zones, scopes, apps) from the Docker
  volume on tailscale-router via a piped tar (zero disk writes on
  production — strictly read-only).
- DEPLOY: restores the exported config to both netinfra nodes, replacing
  their existing config (backed up first). Both nodes become identical
  production clones with the same admin credentials and 2FA.
- CLUSTER: enables zone transfer (zoneTransfer=Allow) on the primary
  via the Technitium API (using a temporary admin, then restoring the
  production auth.config). Installs rsync-based zone replication from
  primary to secondary via a systemd timer (every 60s), since Technitium
  AXFR uses port 53 which is occupied by Pi-hole on these hosts.
- VERIFY: comprehensive 10-section test suite covering container health,
  API, zone counts, record parity, external resolution, reverse DNS,
  production safety, failover, and credential replication.

Scripts:
- remote-dns.sh: SSH chokepoint for all DNS host access
- setup.sh: master orchestrator (export → deploy → cluster → verify)
- sync-zones.sh: rsync-based zone replication (installed as systemd timer)
- verify.sh: 10-section verification suite

Safety:
- tailscale-router is NEVER modified (read-only export only)
- Production auth.config is backed up before any temporary admin swap
- Each node's existing config is backed up before replacement
- The export tarball is gitignored (contains production credentials)

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

dns-cluster-setup/sync-zones.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/bash
+#
+# sync-zones.sh — rsync-based zone replication from primary to secondary
+#
+# Runs on the SECONDARY (netinfra-02). Syncs the zones/ directory from the
+# primary (netinfra-01) every 60 seconds. When a zone file changes, Technitium
+# detects the modification and reloads automatically.
+#
+# This is used instead of AXFR-based zone transfer because Technitium's zone
+# transfer mechanism uses port 53 (standard DNS), but on the netinfra hosts
+# port 53 is Pi-hole and Technitium is on port 5300. rsync-based replication
+# avoids the port conflict entirely.
+#
+# Install as a systemd service/timer or run via cron:
+#   * * * * * /home/localuser/services/technitium/sync-zones.sh
+#
+set -uo pipefail
+
+PRIMARY_HOST="${PRIMARY_HOST:-pfv-netinfra-01.knel.net}"
+CONFIG_DIR="${CONFIG_DIR:-/home/localuser/services/technitium/config}"
+ZONE_DIR="$CONFIG_DIR/zones"
+LOCK_FILE="/tmp/technitium-zone-sync.lock"
+LOG_FILE="${LOG_FILE:-/home/localuser/services/technitium/sync.log}"
+
+log() { printf '[%s] %s\n' "$(date +%H:%M:%S)" "$*" >> "$LOG_FILE"; }
+
+# Prevent overlapping runs
+exec 9>"$LOCK_FILE" || exit 0
+flock -n 9 || { log "another sync is running; skipping"; exit 0; }
+
+mkdir -p "$ZONE_DIR"
+
+# rsync zones from primary. Use --temp-dir to avoid partial writes being
+# picked up by Technitium, and --delete to remove zones deleted on primary.
+log "Syncing zones from $PRIMARY_HOST..."
+if rsync -az --delete --temp-dir=/tmp \
+   "${PRIMARY_HOST}:$ZONE_DIR/" "$ZONE_DIR/" >> "$LOG_FILE" 2>&1; then
+  zone_count=$(ls "$ZONE_DIR" | wc -l)
+  log "Sync complete: $zone_count zones"
+else
+  log "ERROR: rsync failed (rc=$?)"
+  exit 1
+fi