Retire prepare-zones.sh pipeline; zones/ is now the served form

Big migration: the source/prepared split is gone. Each zones/*.zone is
now an RFC-compliant zone file that CoreDNS reads directly. Editing a
record is just edit + bump SOA + commit. CoreDNS auto-reloads within
30s; HE pulls on its own 300s SOA-refresh cycle.

Why: groundwork for the coredns-rfc2136 plugin to edit zones in place
without juggling a source/prepared transformation step. Also reduces
the mental model from "edit source, run prep, push" to just "edit".

Changes:
- zones/*.zone: 84 files migrated from Vultr-export form to RFC-compliant
  form (SOA injected, Vultr NS replaced with HE NS, CNAME/MX/NS rdata
  dot-terminated, apex lines get explicit @ prefix). Diff is mechanical
  and byte-count is unchanged (~340K) -- pure formatting promotion.
- docker-compose.yml: bind ./zones:/zones:ro (was ./zones-prepared)
- Makefile: dropped 'prep' target. 'reload' is now a no-op explainer.
  'tls-up' no longer depends on prep. 'clean' no longer wipes prepared.
- scripts/prepare-zones.sh moved to scripts/archive/ (kept for reference).
- .gitignore: updated comment for zones-prepared/ (now legacy).

NOT in this commit (follow-ups):
- CLAUDE.md updates documenting the new workflow.
- scripts/bump-serials.sh helper for manual-edit SOA bumping.
- coredns-rfc2136 plugin refactor (Phase 2b in the plan).

Makefile

@@ -6,15 +6,24 @@ COMPOSE := docker compose
 include .env
 export
 
-.PHONY: help prep certs up down restart logs logs-caddy ps test test-tls \
+.PHONY: help certs up down restart logs logs-caddy ps test test-tls \
         test-public reload clean tls-up cert-watch caddy-rebuild
 
 help: ## Show this help
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
 
-prep: ## Re-inject SOA + bump serial, then NOTIFY all secondaries (auto-fires AXFR)
-	@./scripts/prepare-zones.sh
-	@./scripts/notify-secondaries.py --quiet || echo "  (NOTIFY had failures; secondaries will still re-poll on SOA refresh)"
+# ---------------------------------------------------------------------------
+# Zone-file edits are now direct: edit zones/*.zone, bump SOA serial,
+# commit. CoreDNS's auto plugin reloads within 30s. HE pulls on its
+# SOA-refresh cycle (300s by zone SOA setting).
+#
+# For manual edits, scripts/bump-serials.sh helps bump CalVer-style
+# serials for zones changed since HEAD. RFC 2136 UPDATEs (via the
+# coredns-rfc2136 plugin) bump serials themselves and auto-commit.
+#
+# The legacy prepare-zones.sh / make prep / notify-he.py pipeline is
+# retired — kept in scripts/archive/ for reference. See CLAUDE.md.
+# ---------------------------------------------------------------------------
 
 certs: ## Generate self-signed dev cert (only useful if not using Caddy ACME)
 	@./scripts/generate-certs.sh
@@ -26,7 +35,7 @@ caddy-rebuild: ## Rebuild the Caddy image (after editing caddy/Dockerfile)
 # Production / Let's Encrypt flow
 # ---------------------------------------------------------------------------
 
-tls-up: prep ## Bring up Caddy → wait for cert → start CoreDNS (one command)
+tls-up: ## Bring up Caddy → wait for cert → start CoreDNS (one command)
 	@if [ -z "$$VULTR_API_KEY" ]; then \
 		echo "ERROR: VULTR_API_KEY is not exported. Set it in your shell:"; \
 		echo "  export VULTR_API_KEY=..."; \
@@ -61,11 +70,12 @@ logs-caddy: ## Tail Caddy logs
 down: ## Stop & remove all containers
 	$(COMPOSE) down
 
-restart: ## Restart CoreDNS (does not re-prep zones / re-issue cert)
+restart: ## Restart CoreDNS (does not re-issue cert)
 	$(COMPOSE) restart coredns
 
-reload: prep ## Re-prep zones; CoreDNS auto-plugin picks changes up
-	@echo "Zones re-prepared. CoreDNS reloads files every 30s (auto plugin)."
+reload: ## Touch zone files so CoreDNS auto plugin picks them up promptly
+	@echo "CoreDNS auto plugin polls zones/ every 30s — no action needed."
+	@echo "If you just edited a zone, ensure the SOA serial was bumped."
 
 logs: ## Tail CoreDNS logs
 	$(COMPOSE) logs -f coredns
@@ -97,8 +107,8 @@ test-public: ## Smoke-test using the public hostname (DoT/DoH ports must be open
 	@echo "=== DoH on public hostname @ port 443 ==="
 	@dig @$(CADDY_HOSTNAME) +https cloudflare.com A +short
 
-clean: down ## Remove containers + prepared zones + dev self-signed certs
-	rm -rf zones-prepared/*.zone certs/*.pem
+clean: down ## Remove containers + dev self-signed certs
+	rm -f certs/*.pem
 
 clean-caddy: down ## Also wipe Caddy's data dir (forces re-issuance from scratch!)
 	@echo "About to delete caddy-data/ — this will force re-issuance from LE."