Porkbun API needs per-domain opt-in

Porkbun rejects every DNS endpoint with DOMAIN_IS_NOT_OPTED_IN_TO_API_ACCESS until the specific domain is opted in via a one-click UI toggle at porkbun.com under the domain's API ACCESS setting (or globally in account settings). The /ping endpoint still succeeds and returns credentialsValid:true, so a working ping does NOT mean any other endpoint will work — easy to misdiagnose as a key/secret problem.