feat: add DNS records MCP server

[Stig-Johnny]

Summary

Adds a new apps/dns-records MCP server with full CRUD operations for Cloudflare DNS records. This is a standalone app separate from dns-analytics, as DNS record management is operationally distinct from analytics reporting.

Closes #251

New Tools

Tool	Description	Annotation
dns_records_list	List/filter DNS records for a zone (by type, name, content) with pagination	readOnlyHint: true
dns_record_get	Get a specific DNS record by ID	readOnlyHint: true
dns_record_create	Create DNS records (A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, PTR)	destructiveHint: false
dns_record_update	Partial update via PATCH semantics (only changed fields)	destructiveHint: false
dns_record_delete	Delete a DNS record	destructiveHint: true

Plus shared accounts_list, set_active_account, zones_list, and zone_details tools from @repo/mcp-common.

Design Decisions

• Separate app rather than extending dns-analytics: DNS record management (CRUD) is operationally distinct from DNS analytics (reporting). This follows the monorepo's pattern of focused, single-purpose MCP servers (e.g., workers-bindings vs workers-observability). Issue Feature Request: DNS Records Management MCP Server #251 also explicitly requests a separate server.
• PATCH semantics for dns_record_update: Uses the SDK's client.dns.records.edit() (PATCH) rather than update() (PUT/full overwrite), so users only need to provide fields they want to change. This is a better fit for MCP tool usage where partial updates are the common case.
• OAuth scopes: Only requests dns_records:read and dns_records:write (plus required base scopes and account:read/zone:read for shared tools). No analytics or settings scopes needed.

Files

apps/dns-records/
├── .dev.vars.example           # Template for local dev credentials
├── .eslintrc.cjs               # Shared ESLint config
├── CONTRIBUTING.md             # Local dev setup guide
├── README.md                   # Tools reference and connection instructions
├── package.json                # Dependencies (matches monorepo patterns)
├── tsconfig.json               # TypeScript config
├── types.d.ts                  # Test type declarations
├── vitest.config.ts            # Test config
├── worker-configuration.d.ts   # Generated Wrangler types
├── wrangler.jsonc              # Worker config (port 8977, dev-only)
└── src/
    ├── dns-records.app.ts      # Main app (DNSRecordsMCP class, OAuth, routing)
    ├── dns-records.context.ts  # Env interface
    └── tools/
        └── dns-records.tools.ts # 5 DNS record CRUD tools

Testing

• All CI checks pass: check:turbo (39/39), check:format, check:deps, test (31/31)
• Tested locally with wrangler dev using DEV_DISABLE_OAUTH=true mode
• Verified all 5 tools work end-to-end against live Cloudflare API (list, get, create, update with PATCH, delete)
• No staging/production environments configured (dev-only for now, following the pattern of new apps in the monorepo)