Add European registrar DNS providers: OVH, Gandi v5, Netcup, Njalla, deSEC

[mhenrixon]

Problem

Every provider in the factory today is a US/global host: Cloudflare, Route53, DigitalOcean, Google Cloud, Namecheap, GoDaddy, Hetzner, Vultr. Operators on European registrars — the audience that reaches for a self-hosted proxy in the first place — have no DNS-01 path and therefore no wildcard certificates.

Scope

Add these five, verified present in the pinned lego v4.30.1:

Provider	lego package	Required env	Optional env
OVH	providers/dns/ovh	OVH_ENDPOINT + OVH_APPLICATION_KEY + OVH_APPLICATION_SECRET + OVH_CONSUMER_KEY, or OVH_ENDPOINT + OVH_CLIENT_ID + OVH_CLIENT_SECRET	OVH_TTL, OVH_PROPAGATION_TIMEOUT, OVH_POLLING_INTERVAL, OVH_HTTP_TIMEOUT
Gandi v5	providers/dns/gandiv5	GANDIV5_PERSONAL_ACCESS_TOKEN or GANDIV5_API_KEY	GANDIV5_TTL, GANDIV5_PROPAGATION_TIMEOUT, GANDIV5_POLLING_INTERVAL, GANDIV5_HTTP_TIMEOUT
Netcup	providers/dns/netcup	NETCUP_CUSTOMER_NUMBER + NETCUP_API_KEY + NETCUP_API_PASSWORD	NETCUP_TTL, NETCUP_PROPAGATION_TIMEOUT, NETCUP_POLLING_INTERVAL, NETCUP_HTTP_TIMEOUT
Njalla	providers/dns/njalla	NJALLA_TOKEN	NJALLA_TTL, NJALLA_PROPAGATION_TIMEOUT, NJALLA_POLLING_INTERVAL, NJALLA_HTTP_TIMEOUT
deSEC	providers/dns/desec	DESEC_TOKEN	DESEC_TTL, DESEC_PROPAGATION_TIMEOUT, DESEC_POLLING_INTERVAL, DESEC_HTTP_TIMEOUT

OVH and Gandi both have two credential shapes, so they exercise the registry's Required [][]string alternatives beyond the Cloudflare case.

Acceptance criteria

• GIVEN --acme-dns-provider ovh and a complete OVH credential set WHEN the proxy starts THEN it obtains an OVH challenge provider rather than ErrProviderNotSupported
• GIVEN only OVH_APPLICATION_KEY is set WHEN the provider is built THEN the error names the specific variables still missing
• GIVEN GANDIV5_PERSONAL_ACCESS_TOKEN alone WHEN the provider is built THEN it succeeds — the alternative credential path is honoured, not just the primary
• GIVEN any of these in the environment and --acme-dns-provider auto THEN auto-detection selects it

Notes

Depends on the registry refactor — each entry should be a single table addition plus a test case. Do not merge this before that lands or it re-adds five copies of the five-site pattern.

Binary size: these pull provider-specific SDK deps into the build. Record the go build size delta before/after in the PR so the curated-vs-all-of-lego tradeoff stays evidence-backed.