bind-internal: allow localhost to query the authoritative cluster

Every bind-operator dynamic update was refused ("denied due to allow-query")
because the operator execs nsupdate against 127.0.0.1 inside the primary pod,
and allow-query listed only the client subnets (auth-acl-main) and the pod net
(10.42.0.0/16) -- not loopback. This blocked ALL DNSRecords (identity, s3,
dashboard, lb1) from ever applying.

- Add localhost to the BindCluster allow-query so in-pod nsupdate passes
  query-authorization; the TSIG key (client-update) still gates the update.

apps/base/bind-internal/authoritative/cluster.yaml

@@ -13,9 +13,11 @@ spec:
   storageSize: 2Gi
   # Restrict queries to internal networks (puppet acl-main.unkin.net).
   # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication.
+  # from the primary during catalog replication. localhost is required so the
+  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
+  # without it every dynamic update is "denied due to allow-query".
   extraOptions:
-    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
+    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
     externalTrafficPolicy: Local