Deploy binddns-auth BIND cluster

Adds the authoritative masters (pod-0 primary + 2 secondaries via catalog/AXFR); includes the catalog zone and transfer TSIG key. Stacked on the bind-operator deploy so the
CRDs and kubeconform schemas are present; merge the operator PR first.

- add apps/base/binddns-auth and its au-syd1 overlay

apps/base/binddns-auth/tsigkey.yaml

@@ -0,0 +1,10 @@
+---
+# Zone-transfer / catalog key. The operator generates the material into a
+# Secret (transfer-key-tsig); nothing sensitive is committed to git.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: transfer-key
+  namespace: binddns-auth
+spec:
+  algorithm: hmac-sha256