feat(dns): add sys-svc-dns role and extend parent DNS handling

Introduce sys-svc-dns to bootstrap Cloudflare DNS prerequisites. Validates CLOUDFLARE_API_TOKEN, (optionally) manages CAA for base SLDs, and delegates parent record creation to sys-dns-parent-hosts. Wired into sys-stk-front-pure.

sys-dns-parent-hosts: new parent_dns filter builds A/AAAA for each parent host and wildcard children (*.parent). Supports dict/list inputs for CURRENT_PLAY_DOMAINS, optional IPv6, proxied flag, and optional *.apex. Exposes a single parent_build_records entry point.

Let’s Encrypt role cleanup: remove DNS/C AA management from sys-svc-letsencrypt; it now focuses on webroot challenge config and renew timer. Fixed path joins and run_once guards.

Tests: update unit tests to allow wildcard outputs and dict-based CURRENT_PLAY_DOMAINS. Add generate_base_sld_domains filter. Documentation updates for both roles.

Conversation: https://chatgpt.com/share/68c342f7-d20c-800f-b61f-cefeebcf1cd8

roles/sys-svc-dns/README.md

@@ -0,0 +1,22 @@
+# sys-svc-dns
+
+Bootstrap and maintain **DNS prerequisites** for your web stack on Cloudflare.
+
+This role validates credentials and (by default) ensures:
+- **Parent host A/AAAA records** (incl. the **apex** SLD.TLD) via `sys-dns-parent-hosts`
+- *(Optional)* **CAA** records for Let’s Encrypt (kept as a commented block you can re-enable)
+
+Runs **once per play** and is safe to include in stacks that roll out many domains.
+
+---
+
+## What it does
+
+1. **Validate `CLOUDFLARE_API_TOKEN`** is present (early fail if missing).
+2. **Ensure parent DNS exists** (apex + “parent” FQDNs derived from children):
+   - Delegates to [`sys-dns-parent-hosts`](../sys-dns-parent-hosts/README.md)
+   - Creates A (and AAAA if enabled upstream) on the Cloudflare zone, optionally proxied.
+3. *(Optional)* **CAA records** for all base SLDs (commented in the tasks; enable if you want CAA managed here).
+
+> Parent hosts example:  
+> `c.wiki.example.com` → **parent** `wiki.example.com` (plus `example.com` apex)