Enable DNSSEC and automatic SOA serials on the DNS zones

ns1 (primary) now signs every zone with an ECDSA P-256/SHA-256 policy and
manages the SOA serial itself: zonefile-load = difference-no-serial (with
journal-content = all) plus serial-policy = dateserial let records be edited
without bumping the serial by hand. ns2 needs no change; it transfers the
already-signed zone.

Also point the ns1/ns2 AAAA glue at the public Hetzner IPv6 addresses; they
previously pointed at unroutable ZeroTier mesh ULAs.

modules/dns/zones/buildfor.life.zone

@@ -2,7 +2,7 @@ $ORIGIN buildfor.life.
 $TTL 3600
 
 @   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
-        2026061401  ; serial   (bump on every edit: YYYYMMDDnn)
+        2026061401  ; serial   (ignored: Knot auto-assigns a dateserial on signing)
         3600        ; refresh
         900         ; retry
         604800      ; expire

modules/dns/zones/cnx.email.zone

@@ -2,7 +2,7 @@ $ORIGIN cnx.email.
 $TTL 3600
 
 @   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
-        2026061401  ; serial   (bump on every edit: YYYYMMDDnn)
+        2026061401  ; serial   (ignored: Knot auto-assigns a dateserial on signing)
         3600        ; refresh
         900         ; retry
         604800      ; expire

modules/dns/zones/cnx.network.zone

@@ -2,7 +2,7 @@ $ORIGIN cnx.network.
 $TTL 3600
 
 @   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
-        2026061402  ; serial   (bump on every edit: YYYYMMDDnn)
+        2026061402  ; serial   (ignored: Knot auto-assigns a dateserial on signing)
         3600        ; refresh
         900         ; retry
         604800      ; expire
@@ -14,9 +14,9 @@ $TTL 3600
 
 ; ---- Glue for the nameservers ----
 ns1     IN  A       46.224.170.206
-ns1     IN  AAAA    fd06:1bad:ece2:92ad:ba99:939d:766d:8974
+ns1     IN  AAAA    2a01:4f8:c014:b5c5::1
 ns2     IN  A       157.180.70.82
-ns2     IN  AAAA    fd06:1bad:ece2:92ad:ba99:9323:61be:a09e
+ns2     IN  AAAA    2a01:4f9:c014:6d87::1
 
 ; ---- control (ZeroTier controller) ----
 control IN  AAAA    fd06:1bad:ece2:92ad:ba99:9306:1bad:ece2