bind-internal: add s3.ceph.unkin.net CNAME -> radosgw.service.consul

Publish the RGW S3 endpoint name used by cephrgw-operator consumers and the
radosgw cert SAN.

- Add a DNSRecord in the ceph.unkin.net zone: s3 CNAME radosgw.service.consul.
  (Consul service target for now; real target to change later.)

apps/base/bind-internal/authoritative/records.yaml

@@ -19,3 +19,18 @@ spec:
     # traefik-internal gateway VIP; the authentik Gateway serves the
     # identity.unkin.net hostname there.
     - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: s3-ceph-cname
+  namespace: bind-internal
+spec:
+  zoneRef: ceph-unkin-net
+  name: s3
+  type: CNAME
+  ttl: 600
+  values:
+    # radosgw S3 endpoint. Points at the Consul service for now; the real
+    # target will be changed later.
+    - radosgw.service.consul.