feat(dns): use structured static record configuration (#2812)

* feat(dns): structure static record configuration and validation

Replace zone-file record strings with name/type/TTL objects and an RDATA
value or literal TXT segments. Keep the existing 20 supported RR types
without adding per-type protocol messages or compatibility formats.

Compile file and management input through one core parser before
accepting a configuration. Validate names, type/data branches, TTL
inheritance, RRset conflicts and complete RDATA consumption with field
paths. Preserve editable input while sorting compiled RRsets by
canonical data. Complete relative SVCB/HTTPS targets against the zone
origin.

Adapt native DNS consumption, generated protocol bindings and frontend
configuration types to the same model. Automatic node records and DNS
publication behavior retain their existing runtime boundaries.

Validate with 98 core configuration tests, 10 native DNS unit/lifecycle
tests, frontend type/build/roundtrip checks and the existing 55 UI
tests. Browser/WASI core checks, workspace fmt and full Clippy pass.
Root/TUN integration is not run because the existing container cannot
load the host-built binary due to its older glibc.

* fix(dns): reject malformed SVCB input before library parsing

Hickory 0.25.2 assumes ALPN list decoding cannot fail. Empty members or
malformed character data instead trigger its expect, now reachable from
shared file and management configuration validation without enabling
Magic DNS.

Validate HTTPS/SVCB ALPN members after the same list unescaping before
calling the library. Reject a lone double-quote parameter value before
the adjacent library quote slicing can panic. Keep valid input tokens
and escaped ALPN data unchanged without catching panics or upgrading the
dependency.

Add one concentrated product regression through TOML and management JSON
configuration generation for invalid lists, escaped token errors, lone
quotes and valid ALPN lists/escapes. Preserve the structured schema, TXT
behavior and DNS runtime boundaries.

Reproduce the dependency panics first, then pass the targeted regression
and all 99 affected configuration tests. Workspace fmt and full Clippy
with -D warnings pass. Reuse prior unaffected frontend, codegen, native
lifecycle and platform checks.

* fix(dns): reject unclosed quoted service parameters

Require every quoted SVCB/HTTPS parameter to have an unescaped closing
quote before the library parser runs. Apply the check to opaque keys as
well as ALPN, preserving valid quoted values and literal backslashes.
Malformed file and management input now returns its existing value path.

Extend the concentrated product regression with unclosed opaque values,
escaped closing quotes and valid quoted parameters. Compare supported
CNAME escapes with the direct library parser and retain field errors for
semicolon and parenthesis labels that Hickory itself rejects. Keep name
tokenization and the structured configuration schema unchanged.

Reproduce the accepted malformed value through management generation,
then pass all 99 configuration tests, workspace fmt and full workspace
Clippy with -D warnings. Reuse unaffected native, frontend and platform
evidence; follow the published candidate's actual CI separately.

easytier-proto/build/main.rs

@@ -181,6 +181,7 @@ fn main() -> anyhow::Result<()> {
     let repeated_types = [
         ".common.RepeatedString",
         ".core_config.RepeatedDnsZoneConfigRaw",
+        ".core_config.RepeatedDnsRecordRaw",
     ];
     for ty in repeated_types {
         config

easytier-proto/proto/core_config.proto

@@ -68,5 +68,48 @@ message RepeatedDnsZoneConfigRaw { repeated DnsZoneConfigRaw items = 1; }
 message DnsZoneConfigRaw {
   string origin = 1;
   optional uint32 ttl = 2;
-  common.RepeatedString records = 3;
+  RepeatedDnsRecordRaw records = 3;
+}
+
+message RepeatedDnsRecordRaw { repeated DnsRecordRaw items = 1; }
+
+// The values are DNS RR type codes, restricted to the supported input types.
+enum DnsRecordType {
+  DNS_RECORD_TYPE_UNSPECIFIED = 0;
+  A = 1;
+  NS = 2;
+  CNAME = 5;
+  SOA = 6;
+  PTR = 12;
+  HINFO = 13;
+  MX = 15;
+  TXT = 16;
+  AAAA = 28;
+  SRV = 33;
+  NAPTR = 35;
+  CERT = 37;
+  SSHFP = 44;
+  TLSA = 52;
+  CSYNC = 62;
+  SVCB = 64;
+  HTTPS = 65;
+  OPENPGPKEY = 61;
+  CAA = 257;
+  ANAME = 65305;
+}
+
+message DnsRecordRaw {
+  string name = 1;
+  DnsRecordType type = 2;
+  optional uint32 ttl = 3;
+  oneof data {
+    // One RDATA in presentation format, without an owner, TTL, class or type.
+    string value = 4;
+    DnsTxtData txt = 5;
+  }
+}
+
+message DnsTxtData {
+  // One UTF-8 character-string per segment, without DNS text escaping.
+  repeated string segments = 1;
 }

easytier-proto/src/core_config.rs

@@ -6,3 +6,9 @@ impl From<Vec<DnsZoneConfigRaw>> for RepeatedDnsZoneConfigRaw {
         Self { items }
     }
 }
+
+impl From<Vec<DnsRecordRaw>> for RepeatedDnsRecordRaw {
+    fn from(items: Vec<DnsRecordRaw>) -> Self {
+        Self { items }
+    }
+}