feat: add full Zonemaster stack with Docker and Spanish UI

- Clone all 5 Zonemaster component repos (LDNS, Engine, CLI, Backend, GUI)
- Dockerfile.backend: 8-stage multi-stage build LDNS→Engine→CLI→Backend
- Dockerfile.gui: Astro static build served via nginx
- docker-compose.yml: backend (internal) + frontend (port 5353)
- nginx.conf: root redirects to /es/, /api/ proxied to backend
- zonemaster-gui/config.ts: defaultLanguage set to 'es' (Spanish)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

zonemaster/test-zone-data/DNSSEC-TP/dnssec16/dnssec16.cfg

@@ -0,0 +1,117 @@
+
+   # ns1.dnssec16.xa
+. {
+    bind 127.15.16.21
+    bind fda1:b2:c3:0:127:15:16:21
+    log
+    file DNSSEC-TP/dnssec16/dnssec16.xa dnssec16.xa
+}
+
+   # ns2.dnssec16.xa
+. {
+    bind 127.15.16.22
+    bind fda1:b2:c3:0:127:15:16:22
+    log
+    file DNSSEC-TP/dnssec16/dnssec16.xa dnssec16.xa
+}
+
+   # testzones ns1
+. {
+    bind 127.15.16.31
+    bind fda1:b2:c3:0:127:15:16:31
+    log
+
+    # cds-invalid-rrsig.dnssec16.xa
+    import cds-invalid-rrsig.cfg
+
+    # cds-matches-no-dnskey.dnssec16.xa
+    import cds-matches-no-dnskey.cfg
+
+    # cds-matches-non-sep-dnskey.dnssec16.xa
+    import cds-matches-non-sep-dnskey.cfg
+
+    # cds-matches-non-zone-dnskey.dnssec16.xa
+    import cds-matches-non-zone-dnskey.cfg
+
+    # cds-not-signed-by-cds.dnssec16.xa
+    import cds-not-signed-by-cds.cfg
+
+    # cds-signed-by-unknown-dnskey.dnssec16.xa
+    import cds-signed-by-unknown-dnskey.cfg
+
+    # cds-unsigned.dnssec16.xa
+    import cds-unsigned.cfg
+
+    # cds-without-dnskey.dnssec16.xa.
+    import cds-without-dnskey.cfg
+
+    # delete-cds.dnssec16.xa.
+    import delete-cds.cfg
+
+    # dnskey-not-signed-by-cds.dnssec16.xa
+    import dnskey-not-signed-by-cds.cfg
+
+    # mixed-delete-cds.dnssec16.xa
+    import mixed-delete-cds.cfg
+
+    # no-cds.dnssec16.xa
+    import no-cds.cfg
+
+    # not-aa.dnssec16.xa
+    import not-aa.cfg
+
+    # valid-cds.dnssec16.xa
+    import valid-cds.cfg
+
+}
+
+
+   # testzones ns2
+. {
+    bind 127.15.16.32
+    bind fda1:b2:c3:0:127:15:16:32
+    log
+
+    # cds-invalid-rrsig.dnssec16.xa
+    import cds-invalid-rrsig.cfg
+
+    # cds-matches-no-dnskey.dnssec16.xa
+    import cds-matches-no-dnskey.cfg
+
+    # cds-matches-non-sep-dnskey.dnssec16.xa
+    import cds-matches-non-sep-dnskey.cfg
+
+    # cds-matches-non-zone-dnskey.dnssec16.xa
+    import cds-matches-non-zone-dnskey.cfg
+
+    # cds-not-signed-by-cds.dnssec16.xa
+    import cds-not-signed-by-cds.cfg
+
+    # cds-signed-by-unknown-dnskey.dnssec16.xa
+    import cds-signed-by-unknown-dnskey.cfg
+
+    # cds-unsigned.dnssec16.xa
+    import cds-unsigned.cfg
+
+    # cds-without-dnskey.dnssec16.xa.
+    import cds-without-dnskey.cfg
+
+    # delete-cds.dnssec16.xa.
+    import delete-cds.cfg
+
+    # dnskey-not-signed-by-cds.dnssec16.xa
+    import dnskey-not-signed-by-cds.cfg
+
+    # mixed-delete-cds.dnssec16.xa
+    import mixed-delete-cds.cfg
+
+    # no-cds.dnssec16.xa
+    import no-cds.cfg
+
+    # not-aa.dnssec16.xa
+    import not-aa.cfg
+
+    # valid-cds.dnssec16.xa
+    import valid-cds.cfg
+
+}