Phase 1.4: UPDATE opcode handler + TSIG verification

Replaces the Phase-1.3 refuseUpdate() stub with a real RFC 2136 handler.
Caddy via caddy-dns/rfc2136 can now inject and remove records.

UPDATE message handling (update.go):
- Zone section validation: must be exactly one SOA-typed record naming
  a zone we're authoritative for. Returns FORMERR/NOTAUTH otherwise.
- Prerequisites (§3.2): name-exists, RRset-exists, name-NOT-exists,
  RRset-NOT-exists semantics implemented. First failure short-circuits
  with the spec's rcode (NXDOMAIN/NXRRSET/YXDOMAIN/YXRRSET).
- Updates (§3.4.2): add RR, delete RRset (CLASS=ANY+RDLEN=0), delete
  all RRsets at name (CLASS=ANY+TYPE=ANY), delete specific RR (CLASS=
  NONE).
- Apex SOA/NS protected: synthetic and cannot be added or removed via
  UPDATE. Apex wipe (TYPE=ANY at apex) also refused.
- Default TTL applied to incoming records with TTL=0.

TSIG (tsig.go + setup.go):
- setup() now populates dnsserver.Config.TsigSecret so the underlying
  dns.Server auto-verifies signatures via miekg/dns.
- checkTSIG() in ServeDNS gates UPDATEs: rejects if no TSIG, unknown
  key name, algorithm-downgrade attempt, or w.TsigStatus() != nil.
- No TSIG keys configured → all UPDATEs refused (safety default).
- Algorithm pinning prevents downgrade attacks (e.g. forced HMAC-MD5).

Tests (update_test.go): 11 new cases covering happy paths and every
error rcode. Total: 35 top-level test passes, 0 failures.

ServeDNS dispatch now calls handleUpdate after auth gate. The
refuseUpdate() stub is gone. UPDATE end-to-end via nsupdate requires
the custom CoreDNS image (Phase 2) to verify TSIG plumbing on the
dns.Server side.

plugin.go

@@ -75,10 +75,17 @@ func (p *RFC2136) Name() string { return "rfc2136" }
 //	  - Name doesn't exist  → NXDOMAIN (NameError + SOA in authority).
 func (p *RFC2136) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
 	if r.Opcode == dns.OpcodeUpdate {
-		// Phase 1.4 will dispatch to update handler. For now, refuse
-		// loudly so clients know the plugin is loaded but not yet
-		// accepting updates.
-		return p.refuseUpdate(w, r)
+		// TSIG verification was performed by the underlying dns.Server
+		// (because setup.go populated dnsserver.Config.TsigSecret). We
+		// just need to check the result here.
+		if err := p.checkTSIG(w, r); err != nil {
+			log.Warningf("UPDATE rejected: %v", err)
+			resp := new(dns.Msg)
+			resp.SetRcode(r, dns.RcodeRefused)
+			_ = w.WriteMsg(resp)
+			return dns.RcodeRefused, nil
+		}
+		return p.handleUpdate(w, r)
 	}
 
 	if len(r.Question) == 0 {
@@ -144,17 +151,6 @@ func (p *RFC2136) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg
 	return dns.RcodeNameError, nil
 }
 
-// refuseUpdate returns REFUSED for UPDATE messages until Phase 1.4
-// wires the proper UPDATE handler. We keep a dedicated method so the
-// "this plugin doesn't yet accept updates" path is searchable in logs.
-func (p *RFC2136) refuseUpdate(w dns.ResponseWriter, r *dns.Msg) (int, error) {
-	log.Warningf("UPDATE opcode received but Phase 1.4 not yet implemented — refusing")
-	msg := new(dns.Msg)
-	msg.SetRcode(r, dns.RcodeRefused)
-	_ = w.WriteMsg(msg)
-	return dns.RcodeRefused, nil
-}
-
 // findZone returns the longest matching zone for qname, or "" if qname
 // is outside all configured zones. The returned zone is in canonical
 // form (lowercase, trailing dot).