Deploy binddns-auth (authoritative BIND cluster) (#220)

Part of the bind rollout split. **Merge #219 (bind-operator) first** — this PR is stacked on it, so its diff will reduce to just the binddns-auth files once #219 merges.

## Why
The authoritative masters tier (replaces 3x Puppet authoritative servers): pod-0 primary + 2 secondaries replicating via the catalog zone + AXFR/IXFR.

## Changes
- `apps/base/binddns-auth`: authoritative `BindCluster` (3 replicas, LoadBalancer/PureLB), `BindCatalogZone`, transfer `BindTSIGKey`, namespace
- au-syd1 `binddns-auth` overlay

## Deploy impact
Creates the `binddns-auth` StatefulSet + LoadBalancer once merged.

Reviewed-on: #220
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/ns-auth/cluster.yaml

@@ -0,0 +1,37 @@
+---
+# Authoritative masters (replaces the 3x Puppet authoritative servers).
+# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: auth
+  namespace: ns-auth
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 2Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.6
+      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so new BindZones auto-provision onto the secondaries.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: auth-catalog
+  namespace: ns-auth
+spec:
+  clusterRef: auth
+  zoneName: catalog.internal
+  transferKeyRef: transfer-key