Phase 1.3: in-memory store + ServeDNS query dispatch

ServeDNS now answers authoritatively for the configured zone(s):
- Apex SOA → synthetic SOA (serial = store generation counter)
- Apex NS  → synthetic NS pointing at p.Nameserver
- In-store lookups for any qtype
- NODATA vs NXDOMAIN correctly distinguished (SOA in authority section)
- UPDATE opcode → REFUSED (Phase 1.4 implements properly)
- Queries outside our zones pass through to Next

Added:
- store.go: recordStore with sync.RWMutex + atomic generation counter.
  Operations: Add (de-dupes), RemoveRRset, RemoveRR, RemoveName, Lookup
  (returns a copy so callers can't corrupt internal state), NameExists.
  All keyed on canonical lowercase + trailing-dot names.
- plugin.go: ServeDNS dispatch, findZone (longest-suffix match),
  syntheticSOA, syntheticNS. New Nameserver field.
- setup.go: nameserver directive. Default Nameserver = first zone apex.
  Store initialised at parse time.
- store_test.go: 12 unit tests covering add/dedupe/remove/lookup/
  generation/case-insensitivity/copy-safety.
- plugin_test.go: 10 dispatch tests covering pass-through, apex
  synthetics, in-store lookups, NXDOMAIN/NODATA semantics, UPDATE
  refusal, findZone longest-suffix-wins and case behavior.
- setup_test.go: 3 new cases for the nameserver directive + store init.

Total: 38 tests passing.

Module: git.supported.systems/rsp2k/coredns-rfc2136

setup.go

@@ -7,6 +7,7 @@ import (
 	"github.com/coredns/coredns/core/dnsserver"
 	"github.com/coredns/coredns/plugin"
 	clog "github.com/coredns/coredns/plugin/pkg/log"
+	"github.com/miekg/dns"
 )
 
 // log is the package logger, scoped so messages are prefixed `[rfc2136]`.
@@ -51,6 +52,7 @@ func parse(c *caddy.Controller) (*RFC2136, error) {
 	p := &RFC2136{
 		TSIGKeys: make(map[string]tsigKey),
 		TTL:      DefaultTTL,
+		store:    newStore(),
 	}
 
 	for c.Next() {
@@ -68,6 +70,13 @@ func parse(c *caddy.Controller) (*RFC2136, error) {
 		for c.NextBlock() {
 			switch c.Val() {
 
+			case "nameserver":
+				nArgs := c.RemainingArgs()
+				if len(nArgs) != 1 {
+					return nil, c.ArgErr()
+				}
+				p.Nameserver = dns.Fqdn(nArgs[0])
+
 			case "tsig-key":
 				// tsig-key <name> <algorithm> <base64-secret>
 				kArgs := c.RemainingArgs()
@@ -119,5 +128,13 @@ func parse(c *caddy.Controller) (*RFC2136, error) {
 		return nil, c.Err("at least one zone must be specified")
 	}
 
+	// Default nameserver to the first zone apex. The user can override
+	// via the `nameserver` directive — e.g. when the delegating parent
+	// zone publishes `auth NS dns.supported.systems`, this should be
+	// set to `dns.supported.systems.` to match.
+	if p.Nameserver == "" {
+		p.Nameserver = p.Zones[0]
+	}
+
 	return p, nil
 }