feat(scale): implement scale dns + scale down (DNS management + strategy-based teardown)

[wjgong001]

Summary

Implements the sh1pt scale dns command group with three sub-commands for managing DNS records on deployed fleets.

Changes

• New file: packages/cli/src/commands/scale-dns.ts — Full DNS command implementation
• Modified: packages/cli/src/commands/scale.ts — Replaced the old stub with scaleCmd.addCommand(dnsCmd) + updated hint in scale up command

Features

• sh1pt scale dns list — Shows current DNS records from the configured provider
• sh1pt scale dns set <hostname> — Point a domain/subdomain to a fleet IP (auto-resolves from state or via --ip)
• sh1pt scale dns remove <hostname> — Remove a DNS record by hostname

Supported DNS Providers

• Cloudflare — Full CRUD via API v4 (requires dns.cloudflare.apiToken + dns.cloudflare.zoneId in credentials)
• Vercel — A record management via Vercel API (requires dns.vercel.apiToken in credentials)
• Namecheap — Basic set support via namecheap XML API (requires dns.namecheap.apiKey + dns.namecheap.email in credentials)

Flags

• --dry-run — Preview changes without execution
• --json — Machine-readable JSON output
• --provider <name> — Select provider (default: cloudflare)
• --ttl <seconds> — DNS TTL (default: 60)
• --proxied — Cloudflare-only: route through CF edge
• --ip <address> — Explicit IP for set command (default: first fleet IP from state)

Credentials Format

DNS provider config is read from ~/.sh1pt/credentials.json under the dns key:

{
  "dns": {
    "cloudflare": {
      "apiToken": "...",
      "zoneId": "..."
    },
    "vercel": {
      "apiToken": "..."
    },
    "namecheap": {
      "apiKey": "...",
      "email": "..."
    }
  }
}

TypeScript

Passes tsc --noEmit cleanly. Follows existing code patterns (Commander.js, kleur, same import style, same error handling).

[wjgong001]

Updated with scale down implementation:

feat(scale): implement scale down with strategy selection

• --instances <n> — how many to destroy (default: 1)
• --provider <id> — filter by provider
• --all — destroy every running instance
• --strategy — cheapest | oldest | random (default: cheapest)
• --dry-run — preview without modifying state
• Reports hourly savings and remaining fleet cost
• Selection respects the shared ~/.sh1pt/credentials.json fleet state

This was the last remaining stub in the scale command group that had a clear spec. Coverage summary:
✅ scale cost — #225
✅ scale auto — #227
✅ scale up — #231
✅ scale dns — #232 (this PR)
✅ scale down — #232 (this PR)

Still stubs: scale rollout (canary/blue-green) and scale status (dashboard) — both marked TODO in the source.