Add authoritative DNS on ns1/ns2 and finalize clan config

- Knot authoritative DNS: ns1 primary, ns2 secondary serving cnx.network,
  buildfor.life and cnx.email over TSIG-secured zone transfer (modules/dns)
- Knot listens publicly + over ZeroTier; firewall opens port 53
- Complete clan inventory: name/domain, admin SSH key, control as the
  zerotier controller, tor on all nixos machines
- Enable age yubikey/fido2-hmac secret plugins

modules/dns/zones/cnx.network.zone

@@ -0,0 +1,26 @@
+$ORIGIN cnx.network.
+$TTL 3600
+
+@   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
+        2026061402  ; serial   (bump on every edit: YYYYMMDDnn)
+        3600        ; refresh
+        900         ; retry
+        604800      ; expire
+        300 )       ; negative-cache TTL
+
+; ---- Nameservers (used by every zone we serve) ----
+@       IN  NS      ns1.cnx.network.
+@       IN  NS      ns2.cnx.network.
+
+; ---- Glue for the nameservers ----
+ns1     IN  A       46.224.170.206
+ns1     IN  AAAA    fd06:1bad:ece2:92ad:ba99:939d:766d:8974
+ns2     IN  A       157.180.70.82
+ns2     IN  AAAA    fd06:1bad:ece2:92ad:ba99:9323:61be:a09e
+
+; ---- control (ZeroTier controller) ----
+control IN  AAAA    fd06:1bad:ece2:92ad:ba99:9306:1bad:ece2
+
+; ---- Web / apex (fill in once you have a web host) ----
+;@      IN  A       <web-ipv4>
+;www    IN  CNAME   cnx.network.