Registrar: only for zones that are a registered domain

With porkbun.domains empty the Registrar tab was offered for every zone
and always failed for subdomain zones, reverse zones and private names.
dnsname.RegisteredDomain (public suffix list) now decides; the others
get a message naming what delegates them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/registrar_test.go

@@ -170,3 +170,29 @@ func writeKey(t *testing.T, dir, zone string) uint16 {
 	os.WriteFile(base+".state", []byte("Algorithm: 13\nKSK: yes\nZSK: yes\nGoalState: omnipresent\nDNSKEYState: omnipresent\nKRRSIGState: omnipresent\nZRRSIGState: omnipresent\nDSState: rumoured\n"), 0o644)
 	return k.KeyTag()
 }
+
+// With no porkbun.domains, only zones that are registered domains get the
+// registrar: not subdomains or reverse zones, which their parent delegates.
+func TestRegistrarOnlyRegisteredDomains(t *testing.T) {
+	fake := porkbun.NewFake("pk1_a", "sk1_b", "adbraun.lol")
+	pts := httptest.NewServer(fake)
+	t.Cleanup(pts.Close)
+	e := newAPIEnvConfig(t, Config{Version: "test", Porkbun: &porkbun.Client{BaseURL: pts.URL + "/api/json/v3", APIKey: "pk1_a", Secret: "sk1_b"}})
+	for _, z := range []string{"adbraun.lol", "lab.adbraun.lol", "10.0.10.0/24", "home.lan"} {
+		e.do("POST", "/zones", e.token, map[string]any{"name": z, "nameservers": []string{"ns1.example.net."}}, 201)
+	}
+	for zone, want := range map[string]string{"adbraun.lol": "porkbun", "lab.adbraun.lol": "", "10.0.10.in-addr.arpa": "", "home.lan": ""} {
+		got, _ := e.do("GET", "/zones/"+zone, e.token, nil, 200)["registrar"].(string)
+		if got != want {
+			t.Errorf("%s: registrar %q, want %q", zone, got, want)
+		}
+	}
+	for zone, msg := range map[string]string{"lab.adbraun.lol": "subdomain of adbraun.lol", "10.0.10.in-addr.arpa": "reverse zone", "home.lan": "isn't a domain registered"} {
+		out := e.do("GET", "/zones/"+zone+"/registrar", e.token, nil, 400)
+		errObj, _ := out["error"].(map[string]any)
+		if m, _ := errObj["message"].(string); !strings.Contains(m, msg) {
+			t.Errorf("%s: %v", zone, out)
+		}
+	}
+	e.do("GET", "/zones/adbraun.lol/registrar", e.token, nil, 200)
+}