Phase 1.3: in-memory store + ServeDNS query dispatch

ServeDNS now answers authoritatively for the configured zone(s):
- Apex SOA → synthetic SOA (serial = store generation counter)
- Apex NS  → synthetic NS pointing at p.Nameserver
- In-store lookups for any qtype
- NODATA vs NXDOMAIN correctly distinguished (SOA in authority section)
- UPDATE opcode → REFUSED (Phase 1.4 implements properly)
- Queries outside our zones pass through to Next

Added:
- store.go: recordStore with sync.RWMutex + atomic generation counter.
  Operations: Add (de-dupes), RemoveRRset, RemoveRR, RemoveName, Lookup
  (returns a copy so callers can't corrupt internal state), NameExists.
  All keyed on canonical lowercase + trailing-dot names.
- plugin.go: ServeDNS dispatch, findZone (longest-suffix match),
  syntheticSOA, syntheticNS. New Nameserver field.
- setup.go: nameserver directive. Default Nameserver = first zone apex.
  Store initialised at parse time.
- store_test.go: 12 unit tests covering add/dedupe/remove/lookup/
  generation/case-insensitivity/copy-safety.
- plugin_test.go: 10 dispatch tests covering pass-through, apex
  synthetics, in-store lookups, NXDOMAIN/NODATA semantics, UPDATE
  refusal, findZone longest-suffix-wins and case behavior.
- setup_test.go: 3 new cases for the nameserver directive + store init.

Total: 38 tests passing.

Module: git.supported.systems/rsp2k/coredns-rfc2136

setup_test.go

@@ -158,6 +158,35 @@ func TestParse(t *testing.T) {
 			shouldErr: true,
 			errMatch:  "duplicate tsig-key",
 		},
+		{
+			name: "nameserver directive overrides default",
+			input: `rfc2136 auth.example.com. {
+                nameserver dns.example.com.
+            }`,
+			check: func(t *testing.T, p *RFC2136) {
+				if p.Nameserver != "dns.example.com." {
+					t.Errorf("Nameserver = %q, want dns.example.com.", p.Nameserver)
+				}
+			},
+		},
+		{
+			name:  "default nameserver is first zone apex",
+			input: `rfc2136 auth.example.com.`,
+			check: func(t *testing.T, p *RFC2136) {
+				if p.Nameserver != "auth.example.com." {
+					t.Errorf("default Nameserver = %q, want auth.example.com.", p.Nameserver)
+				}
+			},
+		},
+		{
+			name: "store is initialised even with no records",
+			input: `rfc2136 auth.example.com.`,
+			check: func(t *testing.T, p *RFC2136) {
+				if p.store == nil {
+					t.Errorf("store should be initialised by parse()")
+				}
+			},
+		},
 		{
 			name: "ttl non-numeric",
 			input: `rfc2136 auth.example.com. {