feat: zone_groups, provider HTTP tests, Porkbun bug fix, case-insensitive ZoneDiff

[cl8dep]

Closes / references

• Closes Zone groups: sync all zones from a source directory without listing each one explicitly #19 — zone_groups: sync all zones from a source without listing each one
• Closes test: provider-level HTTP tests for all 5 DNS providers #63 — provider-level HTTP tests for all 5 DNS providers
• Closes bug: Porkbun update/delete silently falls back to create for subdomain records #64 — Porkbun update/delete silently falls back to create for subdomain records

---

What's in this PR

✨ Features

zone_groups in config — automatic zone discovery from a source provider without listing each zone explicitly. Supports include_pattern / exclude_pattern regex filters. If discovery fails (network/auth error), the group is skipped with a warning and the rest of the sync continues.

zone_groups:
  my-cf-zones:
    source: cloudflare
    targets: [route53]
    include_pattern: '\.dev\.$'   # only .dev zones
    exclude_pattern: '^staging\.' # skip staging

--zone flag on plan / apply / drift — target a single zone without touching config.

🐛 Bug fix — Porkbun update/delete silently became create (#64)

GetExistingRecordIds was keying on NormalizeFqdn("www") → "www.", but RecordChange.RecordName is always a full FQDN "www.example.com.". The key never matched, so every update/delete on a subdomain record silently created a duplicate instead of editing or removing the existing one.

Fixed by replacing NormalizeFqdn with BuildFqdn(name, domain + ".") — matching the same logic already used in ParsePorkbunRecord.

🔍 ZoneDiff case-insensitive grouping

DNS record names are grouped by (name.ToLowerInvariant(), type.ToUpperInvariant()) — prevents phantom changes when a provider returns names in different casing.

🧪 Provider-level HTTP tests (#63)

FakeHttpHandler — shared helper (~50 lines, zero extra NuGet packages) that queues HttpResponseMessage objects and records all requests for assertion. Includes VerifyAllConsumed() to detect fewer-requests-than-expected.

Each provider got an internal constructor accepting an HttpClient for injection. Public constructors are unchanged.

378 tests total (+166 from this PR), all CI-safe — no live credentials required.

Coverage per provider:

Area	CF	Porkbun	GoDaddy	R53	GCP
Auth header	✅	—	✅ sso-key	✅ AWS Sig V4	✅ Bearer
Zones pagination	✅	—	✅ 100-item boundary	✅ marker	✅ pageToken
Record parsing (A, TXT, MX…)	✅	✅	✅	✅	✅
TXT multi-chunk (>255 bytes)	—	—	—	✅	✅
ApplyPlanAsync Create	✅	✅	✅	✅	✅
ApplyPlanAsync Update	✅ PATCH	✅ edit/{id}	✅ PUT	✅ UPSERT	✅ atomic del+add
ApplyPlanAsync Delete	✅	✅ POST /delete	✅ DELETE	✅ DELETE action	✅
Error / retry	✅	✅	✅	✅	✅

Special cases tested:

• Cloudflare TTL=1 (automatic) → normalized to 300
• Porkbun ALIAS → CNAME conversion
• Porkbun Update ID lookup via full FQDN (validates bug fix)
• GCP OAuth bypass via _accessToken = "fake-token" pre-set in internal constructor
• Route53 zone ID bypass — pass hostedZoneId to skip zone discovery

📊 CI / Coverage

• Upload coverage artifact preserved (was accidentally dropped) + upload to Codecov
• Coverage badge in README (live, from Codecov)
• fail_ci_if_error: false on Codecov upload — outages should not block CI

📝 Docs

• ZoneGroupConfig XML doc: explains discovery semantics, soft-fail behaviour, explicit-wins rule
• FakeHttpHandler API documented with XML summary comments

---

Test plan

• dotnet test — 378 tests, 0 failures
• dotnet format --verify-no-changes — no formatting errors
• CI passes (format check → build → test → codecov upload → schema validation)
• No live credentials required

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️