feat: DNS usage pipeline — emit zone/queries events from PowerDNS to billing

[kevwilliams]

Summary

Phase 3 of the catalog registration (#44). Phases 1–2 registered DNS in the catalog and declared the metering contract — including the primary consumption metric dns.networking.miloapis.com/zone/queries (Delta, {query}). This issue covers actually producing that usage: extracting authoritative query counts from the PowerDNS data plane and delivering them to the billing pipeline.

Inventory metrics (zone/hosted, recordset/active) are gauges derivable from existing resource state (see config/milo/resource-metrics/policies/dns-metrics.yaml); the new, harder signal is query volume.

Scope

1. Query-volume source

• PowerDNS exposes query stats via its API (/api/v1/servers/localhost/statistics) and Prometheus metrics. Evaluate scraping from the agent sidecar vs. a dedicated exporter vs. dnsdist.
• Determine granularity: per-zone counters, and breakdown by rcode / record_type to match the declared zone/queries dimensions.

2. Per-tenant attribution

• Map answered queries back to a tenant/zone (DNSZone → consumer project). PowerDNS per-zone stats, query logging, or dnsdist tagging.
• The authoritative servers run in the downstream/agent role; attribution must survive the upstream→downstream replication mapping.

3. CloudEvents emission

• Emit usage as CloudEvents in the billing pipeline's expected format, labeled with the declared dimensions (rcode, record_type, location) and attributed to the DNSZone monitored resource type.

4. Reliability

• Buffering, batching, and delivery guarantees for data-plane → pipeline transmission (at-least-once, dedup/idempotency on the billing side).

Acceptance criteria

• Query-volume collection source selected and documented (PowerDNS stats vs. exporter vs. dnsdist)
• Per-tenant/zone attribution approach implemented and documented
• zone/queries usage events emitted as CloudEvents with the declared dimensions
• Events visible end-to-end in the billing pipeline for a test zone in staging
• Buffering/batching/reliability strategy documented

Context

• Metric contract: config/components/service-catalog/services_v1alpha1_serviceconfiguration_dns.yaml
• Authoritative backend: PowerDNS, deployed via config/agent / infra apps/dns-operator/downstream
• Parent: feat: register DNS in the service catalog #44