NL-03: SPF/DKIM/DMARC DNS identity on Cloudflare for newsletter.org and newsletter.{domain}

- lib/cloudflare.ts: CF DNS API helpers (zone lookup, record list/upsert, proxied CNAME) - lib/dns-identity.ts: generates and applies SPF, DKIM (SES CNAME), DMARC record sets per domain; supports dry-run; reads DKIM tokens from env - app/api/admin/dns-identity/route.ts: admin API to plan (GET) and apply (POST) DNS identity records with dryRun support - scripts/apply-dns-identity.mjs: CLI script for ops to apply DNS identity across domains (DRY_RUN=1 for safe preview) Existing SES send path (lib/ses.ts, cron/send, webhooks/ses, api/unsubscribe) is unchanged and stays wired.