deploy: enable rfc2136 plugin for all 84 production zones

Wires the custom CoreDNS image (built via coredns/Dockerfile, source
includes git.supported.systems/rsp2k/coredns-rfc2136) into production:

- docker-compose.yml: switch coredns service from upstream image pin
  to a build target. New `image: coredns-rfc2136:${COREDNS_IMAGE_TAG}`
  is locally-built; `up -d coredns` triggers the build.
- .env: COREDNS_IMAGE_TAG=2026.05.21 (CalVer). Old COREDNS_IMAGE kept
  as a comment for emergency rollback to upstream 1.11.3.
- Corefile: new rfc2136 directive inside (common) snippet enumerating
  all 84 zones currently in zones/. Plugin is now in the chain for
  every server block (plain DNS, DoT, DoH). UPDATE opcode lands in
  the plugin handler; auto-commit on, CalVer SOA serial bumping on,
  zones-dir /zones matches the existing bind-mount.

TSIG key is read from ${ACME_TSIG_SECRET} which lives in .env.local
(gitignored). Production deployment needs that file synced to dell01
separately.

This commit DOESN'T trigger the deployment by itself -- the image
must be built on dell01 and the container recreated to apply.

docker-compose.yml

@@ -43,7 +43,14 @@ services:
       start_period: 5s
 
   coredns:
-    image: ${COREDNS_IMAGE}
+    # Custom build with the rfc2136 plugin baked in. The image tag is
+    # CalVer (set in .env COREDNS_IMAGE_TAG) so we can pin specific
+    # builds; `docker compose build coredns` produces the locally-tagged
+    # image, then up -d picks it up.
+    build:
+      context: .
+      dockerfile: coredns/Dockerfile
+    image: coredns-rfc2136:${COREDNS_IMAGE_TAG}
     container_name: coredns
     restart: unless-stopped
     command: ["-conf", "/etc/coredns/Corefile"]