feat(gateway): add ForceReleaseCertLock RPC and expose dns credential fields

- Add ForceReleaseCertLock admin RPC to manually release stuck certificate
  renewal locks in WaveKV
- Add dns_txt_ttl and max_dns_wait fields to DnsCredentialInfo proto message
  so these values are returned when querying DNS credentials
- Update dns_cred_to_proto to populate the new fields

Author: kvinwang

gateway/rpc/proto/gateway_rpc.proto

@@ -404,6 +404,8 @@ service Admin {
   rpc DeleteZtDomain(DeleteZtDomainRequest) returns (google.protobuf.Empty) {}
   // Manually trigger certificate renewal for a ZT-Domain
   rpc RenewZtDomainCert(RenewZtDomainCertRequest) returns (RenewZtDomainCertResponse) {}
+  // Force release certificate renewal lock for a ZT-Domain
+  rpc ForceReleaseCertLock(ForceReleaseCertLockRequest) returns (google.protobuf.Empty) {}
   // List certificate attestations for a domain
   rpc ListCertAttestations(ListCertAttestationsRequest) returns (ListCertAttestationsResponse) {}
 
@@ -426,9 +428,13 @@ message DnsCredentialInfo {
   string cf_api_token = 4;
   // Cloudflare API URL (empty means default)
   string cf_api_url = 5;
+  // DNS TXT record TTL in seconds (optional)
+  optional uint32 dns_txt_ttl = 6;
+  // Maximum DNS wait time in seconds (optional)
+  optional uint32 max_dns_wait = 7;
   // Timestamps
-  uint64 created_at = 6;
-  uint64 updated_at = 7;
+  uint64 created_at = 8;
+  uint64 updated_at = 9;
 }
 
 // List DNS credentials response
@@ -560,6 +566,11 @@ message RenewZtDomainCertResponse {
   uint64 not_after = 2;
 }
 
+// Force release certificate lock request
+message ForceReleaseCertLockRequest {
+  string domain = 1;
+}
+
 // Certificate attestation info
 message CertAttestationInfo {
   // Certificate public key (DER encoded)

gateway/src/admin_service.rs

@@ -10,15 +10,15 @@ use dstack_gateway_rpc::{
     admin_server::{AdminRpc, AdminServer},
     CertAttestationInfo, CertbotConfigResponse, CreateDnsCredentialRequest,
     DeleteDnsCredentialRequest, DeleteZtDomainRequest, DnsCredentialInfo,
-    GetDefaultDnsCredentialResponse, GetDnsCredentialRequest, GetInfoRequest, GetInfoResponse,
-    GetInstanceHandshakesRequest, GetInstanceHandshakesResponse, GetMetaResponse,
-    GetNodeStatusesResponse, GetZtDomainRequest, GlobalConnectionsStats, HandshakeEntry, HostInfo,
-    LastSeenEntry, ListCertAttestationsRequest, ListCertAttestationsResponse,
-    ListDnsCredentialsResponse, ListZtDomainsResponse, NodeStatusEntry,
-    PeerSyncStatus as ProtoPeerSyncStatus, RenewCertResponse, RenewZtDomainCertRequest,
-    RenewZtDomainCertResponse, SetCertbotConfigRequest, SetDefaultDnsCredentialRequest,
-    SetNodeStatusRequest, SetNodeUrlRequest, StatusResponse, StoreSyncStatus,
-    UpdateDnsCredentialRequest, WaveKvStatusResponse, ZtDomainCertStatus,
+    ForceReleaseCertLockRequest, GetDefaultDnsCredentialResponse, GetDnsCredentialRequest,
+    GetInfoRequest, GetInfoResponse, GetInstanceHandshakesRequest, GetInstanceHandshakesResponse,
+    GetMetaResponse, GetNodeStatusesResponse, GetZtDomainRequest, GlobalConnectionsStats,
+    HandshakeEntry, HostInfo, LastSeenEntry, ListCertAttestationsRequest,
+    ListCertAttestationsResponse, ListDnsCredentialsResponse, ListZtDomainsResponse,
+    NodeStatusEntry, PeerSyncStatus as ProtoPeerSyncStatus, RenewCertResponse,
+    RenewZtDomainCertRequest, RenewZtDomainCertResponse, SetCertbotConfigRequest,
+    SetDefaultDnsCredentialRequest, SetNodeStatusRequest, SetNodeUrlRequest, StatusResponse,
+    StoreSyncStatus, UpdateDnsCredentialRequest, WaveKvStatusResponse, ZtDomainCertStatus,
     ZtDomainConfig as ProtoZtDomainConfig, ZtDomainInfo,
 };
 use ra_rpc::{CallContext, RpcCall};
@@ -541,6 +541,16 @@ impl AdminRpc for AdminRpcHandler {
         }
     }
 
+    async fn force_release_cert_lock(self, request: ForceReleaseCertLockRequest) -> Result<()> {
+        let kv_store = self.state.kv_store();
+        kv_store.release_cert_lock(&request.domain)?;
+        info!(
+            "Force released certificate lock for domain: {}",
+            request.domain
+        );
+        Ok(())
+    }
+
     async fn list_cert_attestations(
         self,
         request: ListCertAttestationsRequest,
@@ -695,6 +705,8 @@ fn dns_cred_to_proto(cred: DnsCredential) -> DnsCredentialInfo {
         cf_api_url,
         created_at: cred.created_at,
         updated_at: cred.updated_at,
+        dns_txt_ttl: Some(cred.dns_txt_ttl),
+        max_dns_wait: Some(cred.max_dns_wait.as_secs() as u32),
     }
 }