Add extended forward zone type for overriding public domain records

An extended zone answers authoritatively only for the records it holds
locally; any name with nothing configured falls through to recursive
resolution instead of a synthesized NXDOMAIN, so a public domain's
records don't need to be duplicated just to override a few of them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V8c76Xr2BycaHHu5N4buqi

internal/authoritative/answer.go

@@ -4,6 +4,8 @@ import (
 	"strings"
 
 	"github.com/miekg/dns"
+
+	"github.com/owen/vibedns/internal/models"
 )
 
 // maxCNAMEChain bounds in-zone CNAME following so a loop cannot hang a query.
@@ -53,6 +55,18 @@ func (z *Zone) Answer(req *dns.Msg, do bool) *dns.Msg {
 		node, synthesised := z.resolveNode(name)
 
 		if node == nil {
+			// An extended zone is only authoritative for the records it
+			// explicitly holds. A name with nothing configured for it - at
+			// the queried name itself, or reached by following a locally
+			// configured CNAME - is not ours to answer NXDOMAIN or NODATA
+			// for: the caller falls through to recursive resolution so the
+			// name is looked up on the public DNS instead.
+			if z.Kind == models.ZoneExtended {
+				if depth == 0 {
+					return nil
+				}
+				return m
+			}
 			// The name has no data. Distinguish "exists but no records of this
 			// type" (NODATA) from "does not exist at all" (NXDOMAIN).
 			if _, exists := z.ents[name]; exists || depth > 0 {