Phase 0 scaffolding: RFC 2136 plugin groundwork (inactive)

Lays the groundwork for a future CoreDNS rfc2136 plugin that will accept
TSIG-authenticated dynamic DNS updates from Caddy (via caddy-dns/rfc2136),
enabling self-hosted ACME DNS-01 cert automation without depending on
registrar APIs.

Nothing in this commit is active at runtime:
- Corefile additions are commented out
- coredns/Dockerfile references a plugin repo that doesn't exist yet
- scripts/acme-add-domain.sh just appends CNAME glue but has nothing
  to talk to until the plugin is built

Architecture and implementation plan:
  ~/.claude/plans/dood-does-coredns-offer-enumerated-piglet.md

Secret management: TSIG key generated and stored in .env.local
(gitignored). .env.local.example documents the expected shape.

Corefile

@@ -57,3 +57,29 @@ https://.:443 {
     tls /etc/coredns/certs/cert.pem /etc/coredns/certs/key.pem
     import common
 }
+
+# ─── PHASE 0 SCAFFOLDING — NOT YET ACTIVE ──────────────────────────
+# Dynamic-update server for ACME DNS-01 challenges (RFC 2136 + TSIG).
+# Caddy uses caddy-dns/rfc2136 to push TSIG-signed UPDATE messages here;
+# the plugin stores TXT records in memory and serves them for Let's
+# Encrypt's validation queries.
+#
+# Activation requires:
+#   1. The coredns-rfc2136 plugin built into a custom CoreDNS image
+#      (see coredns/Dockerfile and docker-compose.yml build directive).
+#   2. ACME_TSIG_SECRET set in .env.local (already generated).
+#   3. zones/supported.systems.zone delegating `auth` sub-zone to dell01:
+#        auth   300   IN   NS   dns.supported.systems.
+#   4. FortiWiFi firewall opening UDP/53 to dell01 from 0.0.0.0/0.
+#
+# Until those land, this block is a comment. The plan lives at
+#   ~/.claude/plans/dood-does-coredns-offer-enumerated-piglet.md
+#
+# .:53 auth.supported.systems {
+#     rfc2136 auth.supported.systems {
+#         tsig-key acme-update-key. hmac-sha256 {$ACME_TSIG_SECRET}
+#         ttl 60
+#     }
+#     errors
+#     log
+# }