bind-internal: allow localhost to query the authoritative cluster (#267)

## Why

Every bind-operator dynamic update is refused (`update ... denied due to allow-query`) because the operator execs `nsupdate` against `127.0.0.1` inside the primary pod, and the BindCluster `allow-query` listed only the client subnets (`auth-acl-main`) and the pod net (`10.42.0.0/16`) — not loopback. This blocked ALL DNSRecords (identity, s3, dashboard, lb1) from ever applying.

## Change

- Add `localhost` to the BindCluster `allow-query` in `apps/base/bind-internal/authoritative/cluster.yaml`. The `client-update` TSIG key still gates the actual update.

---------

Co-authored-by: benvin <neotheo@gmail.com>
Reviewed-on: #267
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/bind-internal/authoritative/cluster.yaml

@@ -13,9 +13,11 @@ spec:
   storageSize: 2Gi
   # Restrict queries to internal networks (puppet acl-main.unkin.net).
   # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication.
+  # from the primary during catalog replication. localhost is required so the
+  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
+  # without it every dynamic update is "denied due to allow-query".
   extraOptions:
-    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
+    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
     externalTrafficPolicy: Local