Sign responses to TSIG-signed UPDATEs (RFC 8945 §5.4.2)

When a request arrives with TSIG, attach a TSIG record to the response
so dns.ResponseWriter computes the MAC at write time using the secret
in TsigSecret. Without this, BIND nsupdate complains "expected a TSIG
or SIG(0)" on every UPDATE, even when the update applies successfully.

Two response paths fixed:
  - handleUpdate success/per-rcode replies (update.go)
  - ServeDNS rejection when TSIG verification fails (plugin.go)

The new helper in tsig.go is a no-op for unsigned requests. Unknown
keys still silently skip signing — we can't authenticate to a peer we
don't share a key with.

Tests verify both branches: signed request → response carries matching
TSIG (key name + algorithm); unsigned request → response stays plain.

plugin.go

@@ -80,6 +80,12 @@ func (p *RFC2136) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg
 			log.Warningf("UPDATE rejected: %v", err)
 			resp := new(dns.Msg)
 			resp.SetRcode(r, dns.RcodeRefused)
+			// Best-effort: if the request had TSIG and we recognize
+			// the key, the framework will sign the rejection so the
+			// client can authenticate "yes, server rejected this."
+			// Unknown keys silently skip signing — correct, since we
+			// can't prove identity to a peer we don't share a key with.
+			signResponseIfSigned(resp, r)
 			_ = w.WriteMsg(resp)
 			return dns.RcodeRefused, nil
 		}