Epic: ACME DNS-01 provider coverage — registry refactor + curated providers

[mhenrixon]

Tracking epic for ACME DNS-01 provider coverage in dash-proxy. Split out of the R1–R5 roadmap epic (zoolutions/kamal#13) because it is a distinct concern: R1–R7 is proxy features and the gem flag surface that exposes them, this is credential plumbing for certificate issuance.

Goal: an operator on a mainstream registrar can get a wildcard certificate without patching the proxy, and adding provider number thirteen is a one-line table entry rather than a seven-file change.

Why now

internal/server/acme/providers/factory.go supports eight providers, all US/global hosts. Each one is spread across five edit sites — the lego import, a ProviderInfo entry, a NewProvider switch case, a bespoke newXProvider() credential check, and two separately-maintained ordered lists (autoDetectProvider's providerOrder and DetectProviderName's checks). Those two lists must agree and nothing asserts that they do.

So the refactor comes first and everything else is cheap after it.

Order

Strictly sequential for the first two; the provider batches are independent of each other once the registry exists.

• Collapse the ACME provider factory into a single registry table #72 — Collapse the ACME provider factory into a single registry table proxy M
• Derive the provider table and --acme-dns-provider help from the registry #75 — Derive the provider table and --acme-dns-provider help from the registry proxy S
• R4: Add Loopia DNS-01 provider to the ACME provider factory #22 — Add Loopia proxy S
• Add European registrar DNS providers: OVH, Gandi v5, Netcup, Njalla, deSEC #73 — Add European registrars: OVH, Gandi v5, Netcup, Njalla, deSEC proxy S
• Add DNSimple, Linode, Porkbun, Bunny, Azure DNS and Alibaba Cloud DNS providers #74 — Add DNSimple, Linode, Porkbun, Bunny, Azure DNS, Alibaba Cloud DNS proxy M
• README wildcard-with-Kamal recipe configures the app containers, not the proxy #76 — Fix the README wildcard-with-Kamal recipe (configures app containers, not the proxy) proxy bug S

Doing #75 second means the two provider batches get the README drift check for free instead of hand-editing a 20-row table twice.

Coverage after this epic

8 providers today → 21. Verified present in the pinned lego v4.30.1:

cloudflare route53 digitalocean gcloud namecheap godaddy hetzner vultr — today
loopia ovh gandiv5 netcup njalla desec — European batch
dnsimple linode porkbun bunny azuredns alidns — remaining batch

Curated rather than all ~150 of lego's: each provider pulls its SDK into the binary, and the credential metadata has to be honest per provider. Both batch issues require recording the go build size delta so the curated-vs-everything tradeoff stays evidence-backed rather than assumed.

Not in scope

• Gem-side deploy.yml keys for ACME config. Tracked in the R7 section of Epic: dash / dash-proxy improvement roadmap (R1–R5) kamal#13. Today the only supported path is the raw proxy.run.options.env docker passthrough, which has no .kamal/secrets integration — README wildcard-with-Kamal recipe configures the app containers, not the proxy #76 documents that honestly, and the gem issue fixes it properly.
• On-demand TLS and the domains poller — already shipped, R4.

Release

This epic does not gate the proxy v1.0.0.0 release. The registry refactor is behaviour-preserving and the provider batches are additive, so they can land before or after the tag. If they land after, they ship in the next fork counter.