Add identity.unkin.net internal DNS record

identity.unkin.net was configured as the Authentik OIDC issuer but has no DNS
record anywhere, so in-cluster OIDC discovery (e.g. argocd-server) fails to
resolve it. Add an authoritative A record via the bind-operator so the
internal bind system serves it.

- New DNSRecord identity-dns-internal -> 198.18.200.4 (traefik-internal VIP,
  where the authentik Gateway serves the identity.unkin.net hostname).
- Placed in the bind-internal namespace alongside the unkin-net BindZone: the
  operator resolves zoneRef/clusterRef/updateKeyRef within the record's own
  namespace, so it cannot live in the app namespace.
- "internal" in the name distinguishes it from the external DNS Authentik will
  manage its own records from later.

apps/base/bind-internal/authoritative/kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
+  - records.yaml
   - acls.yaml

apps/base/bind-internal/authoritative/records.yaml

@@ -0,0 +1,21 @@
+# Individually-managed authoritative records for the unkin.net zone.
+# DNSRecords must live in the same namespace as their BindZone (the operator
+# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
+# these sit alongside the zone in bind-internal, not in the app namespace.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  # "internal" in the name distinguishes this from the external DNS that
+  # Authentik will manage its own records from later.
+  name: identity-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: identity
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the authentik Gateway serves the
+    # identity.unkin.net hostname there.
+    - 198.18.200.4