Add primary (write) Services to authoritative + externaldns (#229)

**Stacked on #228** (needs operator v0.1.5). Merge #228 first; the diff collapses to just this after.

## Why
Writes (RFC2136/nsupdate) must go to pod-0 — the round-robin read Service would land them on a secondary (rejected). Adds a dedicated write endpoint per cluster (operator v0.1.5 `primaryService`).

## Changes
- `bind-authoritative`: LoadBalancer write endpoint on **198.18.200.9** (`bind-authoritative-primary`)
- `bind-externaldns`: ClusterIP write endpoint (`bind-externaldns-primary`, for in-cluster writers)
- regenerate the bindcluster kubeconform schema (primaryService + externalTrafficPolicy)

## Deferred
external-dns is **not** repointed at `bind-externaldns-primary` yet: it authenticates with the existing TSIG key, which the operator-generated key won't match until the planned Vault-sync + secret-reflection features exist. Until then external-dns keeps writing to the puppet externaldns.

## Validated
kustomize build + kubeconform (3 BindClusters valid against the v0.1.5 schema).

---------

Co-authored-by: BenVincent <benvin@main.unkin.net>
Reviewed-on: #229
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/bind-internal/authoritative/cluster.yaml

@@ -18,10 +18,17 @@ spec:
     - "allow-query { auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
+    externalTrafficPolicy: Local
     annotations:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.6
       external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
+  primaryService:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.9
+      external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
   resources:
     requests:
       cpu: 100m

apps/base/bind-internal/externaldns/cluster.yaml

@@ -14,10 +14,13 @@ spec:
   storageSize: 1Gi
   service:
     type: LoadBalancer
+    externalTrafficPolicy: Local
     annotations:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.8
       external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net
+  primaryService:
+    type: ClusterIP
   resources:
     requests:
       cpu: 100m

apps/base/bind-internal/resolvers/cluster.yaml

@@ -13,6 +13,7 @@ spec:
   storageSize: 1Gi
   service:
     type: LoadBalancer
+    externalTrafficPolicy: Local
     annotations:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.7

schemas/bind.unkin.net/bindcluster_v1alpha1.json

@@ -692,6 +692,35 @@
           },
           "type": "object"
         },
+        "primaryService": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "enum": [
+                "Cluster",
+                "Local"
+              ],
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "ClusterIP",
+                "LoadBalancer",
+                "NodePort"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
         "recursion": {
           "type": "boolean"
         },
@@ -765,6 +794,13 @@
               },
               "type": "object"
             },
+            "externalTrafficPolicy": {
+              "enum": [
+                "Cluster",
+                "Local"
+              ],
+              "type": "string"
+            },
             "loadBalancerIP": {
               "type": "string"
             },