dns: fix dns-update fqdn() double-appending zone to FQDN records

profiles::dns::record publishes some records with an already-qualified name
(trailing dot), e.g. au-syd1-pve.main.unkin.net., cobbler.main.unkin.net.,
dashboard.ceph.unkin.net., and the halb service CNAMEs. The dns-update
script's fqdn() unconditionally appended the zone, producing a '..' empty
label; nsupdate rejects the whole per-zone update with 'invalid owner name:
empty label' + 'syntax error'. The reverse-PTR send (sorted first, always
relative) still applied, so affected hosts ended up with a PTR but no A.

Handle the already-FQDN case (name ends in '.') by using it verbatim; keep
the apex ('@'/empty) and relative cases as before.

Fixes hosts stuck with PTR-but-no-A (e.g. ausyd1nxvm2069-2073, 2098) and
repopulates the unkin.net service records (git/grafana/auth/fafflix).

site/profiles/templates/dns/dns-update.sh.epp

@@ -20,7 +20,15 @@ applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)
 [ "$desired" = "$applied" ] && exit 0
 
 fqdn() { # name zone
-  if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
+  # $1 may be relative to the zone, "@"/empty for the apex, or already a FQDN
+  # (trailing dot). Only append the zone in the relative case; appending it to
+  # an already-qualified name yields a "..", which nsupdate rejects as an
+  # "invalid owner name: empty label".
+  case "$1" in
+    ''|'@') printf '%s.' "$2" ;;
+    *.)     printf '%s' "$1" ;;
+    *)      printf '%s.%s.' "$1" "$2" ;;
+  esac
 }
 
 msg="$(mktemp)"