Add dynamic DNS: keep A records pointed at the current public IP

For deployments on WAN DHCP, operators can declare A records in the DNS section
that the app updates to this box's current public IP every 4 hours (and
immediately on create).

- utils/public_ip.js: getPublicIp() queries external echo services (ipify +
  fallbacks, configurable) with pure isIPv4/extractIp helpers.
- utils/dns_records.js: pure planARecordUpdate() reconciliation decision.
- models/dns_provider.js: Domain.upsertARecord(name, ip) — provider-agnostic
  upsert via getRecords + deleteRecordById + createRecord (createRecord alone is
  not a reliable cross-provider upsert). Apex ('@') handling added to each
  provider (CloudFlare uses the domain name, Porkbun an empty name, DigitalOcean
  '@') via a new DnsApi.apexName().
- models/dynamic_record.js: DynamicRecord model (deterministic id per host,
  apply()/refreshAll()), registered + ModelPs-wrapped for live UI updates.
- services/dynamic_dns.js + conf: 4h scheduler mirroring host_scheduler.
- routes/dns.js: /dynamic CRUD + /dynamic/ip, gated to domain managers/admins.
- views/dns.ejs: "Dynamic A Records (WAN IP)" card with add form + list.
- test/unit/dynamic_record.test.js: public-IP parsing + reconciliation logic.

Verified end-to-end against a live Porkbun domain (create, idempotent, IP-change,
cleanup) plus unit suite (111 pass).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/dns.js

@@ -1,8 +1,10 @@
 'use strict';
 
 const router = require('express').Router();
-const {DnsProvider, Domain} = require('../models').models;
+const {DnsProvider, Domain, DynamicRecord} = require('../models').models;
 const authz = require('../middleware/authz');
+const {Grant} = require('../models/grant');
+const {getPublicIp} = require('../utils/public_ip');
 
 const Model = DnsProvider;
 
@@ -76,6 +78,81 @@ router.get('/domain/:item', authz.requireDomainRole('viewer', authz.resolve.doma
 	}
 });
 
+// ---- Dynamic DNS: A records kept pointed at this box's public (WAN) IP ----
+// Registered before the '/:item' provider routes so '/dynamic' isn't captured.
+
+// Current public IP, for the UI to display.
+router.get('/dynamic/ip', async function(req, res, next){
+	try{
+		return res.json({ip: await getPublicIp()});
+	}catch(error){
+		return next(error);
+	}
+});
+
+// List dynamic records the caller may view (own/granted domains, or all for admin).
+router.get('/dynamic', async function(req, res, next){
+	try{
+		let results = await DynamicRecord.listDetail();
+		results = await authz.filterViewable(req, results, r => r.domain);
+		return res.json({results});
+	}catch(error){
+		return next(error);
+	}
+});
+
+// Create a record (manager on its domain), then apply it immediately.
+router.post('/dynamic', authz.requireDomainRole('manager', req => req.body.domain), async function(req, res, next){
+	try{
+		req.body.created_by = authz.reqUsername(req);
+		let item = await DynamicRecord.create(req.body);
+
+		// Point it at the current IP now rather than waiting for the next cycle.
+		// apply() swallows its own errors (recorded in last_status).
+		try{ await item.apply(await getPublicIp()); }catch(error){ /* scheduler will retry */ }
+
+		let record = await DynamicRecord.get(item.id);
+		return res.json({message: `"${record.fqdn()}" added.`, ...record});
+	}catch(error){
+		return next(error);
+	}
+});
+
+// Force an immediate refresh of one record (manager on its domain).
+router.post('/dynamic/:id/refresh', async function(req, res, next){
+	try{
+		let record = await DynamicRecord.get(req.params.id);
+		let effective = await authz.getEffective(req);
+		if(!Grant.allows(effective, 'manager', authz.toDomain(record.domain))){
+			let error = new Error('Forbidden'); error.name = 'Forbidden'; error.status = 403;
+			error.message = `You need 'manager' rights on ${record.domain}.`;
+			throw error;
+		}
+		let result = await record.apply(await getPublicIp());
+		return res.json({message: `Refreshed "${record.fqdn()}".`, result});
+	}catch(error){
+		return next(error);
+	}
+});
+
+// Stop managing a record (manager on its domain). Leaves the provider A record
+// in place at its last value.
+router.delete('/dynamic/:id', async function(req, res, next){
+	try{
+		let record = await DynamicRecord.get(req.params.id);
+		let effective = await authz.getEffective(req);
+		if(!Grant.allows(effective, 'manager', authz.toDomain(record.domain))){
+			let error = new Error('Forbidden'); error.name = 'Forbidden'; error.status = 403;
+			error.message = `You need 'manager' rights on ${record.domain}.`;
+			throw error;
+		}
+		await record.remove();
+		return res.json({message: `${record.fqdn()} removed.`, ...record});
+	}catch(error){
+		return next(error);
+	}
+});
+
 router.get('/:item', authz.requireAdmin, async function(req, res, next){
 	try{