coredns: docker compose stack with Vultr zone import

- Auto plugin loads zones-prepared/*.zone (regex zone-name extraction)
- scripts/prepare-zones.sh transforms raw Vultr exports:
  * synthesizes SOA (omitted by Vultr; CoreDNS requires it)
  * prepends @ to leading-TAB apex lines to disambiguate owner inheritance
  * dot-terminates NS/MX/CNAME rdata so $ORIGIN doesn't double-suffix
- DNS_PORT defaults to 1053 (5353=avahi, 53=libvirt dnsmasq on this host)
- Forwards non-authoritative queries to 1.1.1.1/1.0.0.1/9.9.9.9
- Makefile targets: prep, up, down, reload, test, logs
- 91 zones loaded

Makefile

@@ -0,0 +1,39 @@
+.DEFAULT_GOAL := help
+SHELL := /usr/bin/env bash
+COMPOSE := docker compose
+
+.PHONY: help prep up down restart logs ps test reload clean
+
+help: ## Show this help
+	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+
+prep: ## Re-inject SOA records into all zones (writes zones-prepared/)
+	@./scripts/prepare-zones.sh
+
+up: prep ## Start CoreDNS (prepares zones first)
+	$(COMPOSE) up -d
+	@sleep 2 && $(COMPOSE) logs --tail=20 coredns
+
+down: ## Stop & remove the container
+	$(COMPOSE) down
+
+restart: ## Restart CoreDNS (does not re-prep zones)
+	$(COMPOSE) restart coredns
+
+reload: prep ## Re-prep zones; CoreDNS auto-plugin will pick changes up
+	@echo "Zones re-prepared. CoreDNS reloads files every 30s (auto plugin)."
+
+logs: ## Tail CoreDNS logs
+	$(COMPOSE) logs -f coredns
+
+ps: ## Show container status
+	$(COMPOSE) ps
+
+test: ## Smoke-test against a known zone (uses DNS_PORT from .env)
+	@. ./.env && echo "Querying acrazy.org @ 127.0.0.1:$$DNS_PORT" && \
+		dig @127.0.0.1 -p $$DNS_PORT acrazy.org SOA +short && \
+		dig @127.0.0.1 -p $$DNS_PORT acrazy.org NS +short && \
+		dig @127.0.0.1 -p $$DNS_PORT or.acrazy.org A +short
+
+clean: down ## Remove containers + prepared zones
+	rm -rf zones-prepared/*.zone