Refactor DDNS updater code

[yorickdowne]

What I did

Refactor the DDNS updater so it can use multiple providers. Add the CloudFlare provider. Add a test harness for the new code, so it can be tested end-to-end

CF_ZONE_API_TOKEN is gone, this split is no longer needed: A scoped DNS Edit token now suffices for CloudFlare to be able to get the zone ID from a domain name.

This refactor heavily relied on opencode's "Big Pickle" model, with human review and revision

[yorickdowne]

Route 53 test results

--- Test: Route53 basic update cycle (wait 20s) ---
✓ AWS identity verified (validate() succeeded)
✓ Auth via environment variables
✓ A record was updated
✓ AAAA record was updated
✓ CNAME record was updated

--- Test: Route53 missing credentials (expected failure) ---
✓ Gracefully rejected missing credentials

--- Test: Unknown provider (expected failure) ---
✓ Gracefully rejected unknown provider

All requested tests complete.

[yorickdowne]

CloudFlare test results

--- Test: Cloudflare basic update cycle (wait 20s) ---
✓ Cloudflare validation passed
✓ A record is already up-to-date (no change needed)
✓ AAAA record already up-to-date (no change needed)
✓ CNAME record already up-to-date (no change needed)

--- Test: Cloudflare invalid token (expected failure) ---
✓ Gracefully rejected invalid token

All requested tests complete.