Implement AXFR over TCP and RFC 2136 UPDATE with caller TSIG.

Callers get a session API, typed RR builders, and BIND testcontainer proof so CheckDNS can stay off the DNS wire.

Co-authored-by: Cursor <cursoragent@cursor.com>

client_test.go

@@ -0,0 +1,51 @@
+package godns_test
+
+import (
+	"strings"
+	"testing"
+
+	godns "gitea.neitzel.de/konrad/go-dns"
+)
+
+func TestNewClientRejectsNonASCIIZone(t *testing.T) {
+	t.Parallel()
+
+	_, err := godns.NewClient("127.0.0.1:53", "exämple.test", fixtureTSIG())
+	if err == nil {
+		t.Fatal("expected error for non-ASCII zone name")
+	}
+	if !strings.Contains(strings.ToLower(err.Error()), "ascii") {
+		t.Fatalf("error should mention ASCII, got %v", err)
+	}
+}
+
+func TestNewClientRejectsEmptyTSIG(t *testing.T) {
+	t.Parallel()
+
+	_, err := godns.NewClient("127.0.0.1:53", "example.test", godns.TSIG{})
+	if err == nil {
+		t.Fatal("expected error for empty TSIG")
+	}
+}
+
+func TestNewClientAcceptsASCIIZone(t *testing.T) {
+	t.Parallel()
+
+	client, err := godns.NewClient("127.0.0.1", "example.test", fixtureTSIG())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if client == nil {
+		t.Fatal("expected client")
+	}
+}
+
+const fixtureSecret = "dGVzdC1maXh0dXJlLWhtYWMtc2hhMjU2LWtleSEhISE="
+
+func fixtureTSIG() godns.TSIG {
+	return godns.TSIG{
+		Name:      "go-dns-test",
+		Algorithm: "hmac-sha256",
+		Secret:    fixtureSecret,
+	}
+}