PowerDNS API Simulator — project rules

Read PLAN.md before doing anything. It is the spec; docs/SEMANTICS.md (produced in Phase 0) is the data-shape contract.

Invariants that hold in every session and every subagent:

Configuration is environment variables ONLY. No config files. config.yaml and its loader are being removed, not maintained.
Never run acme.sh against the Let's Encrypt production CA. --staging always.
The live MySQL schema is the source of truth for the CoreDNS side, not plugin documentation. Verify against the running DB.
Dockerfile and Makefile already exist: follow their style, amend only when required, never rewrite.
The binary starts as root and drops to PUID/PGID before serving. Do not add a USER directive to the Dockerfile.
DNS verification goes through dig @1.2.3.4 (authoritative, no cache). Remember CoreDNS zone_update_interval before declaring a propagation failure.
Follow existing repository style. Direct, minimal output. No speculative features beyond PLAN.md's scope; the Explicit non-goals section is binding.