feat(24-05): CRUD write routes with pending/committed/failed audit lifecycle

- app/api/route53/zones/[zoneId]/records/route.ts: add POST (create)
- app/api/route53/zones/[zoneId]/records/[recordId]/route.ts: PATCH (update), DELETE
- All three write handlers: requireAdmin() first (D-04), validateRecordWrite() before
  any AWS command (D-01), createPendingAuditLog() before submitRecordChange() (D-07/SC-3)
- Committed path: markAuditCommitted -> insertPulseCrudHistory (pulse_crud, SC-4) ->
  mirror refresh; failed path: sanitizeAwsError -> markAuditFailed -> 502, no history row
- DELETE submits the exact mirror-read recordset (name/type/ttl/resourceRecords), never
  client-supplied values, per Route 53's exact-match delete requirement
- recordId zone-prefix mismatch guard (T-24-17): 400 before any audit row or AWS call
- No staged-approval mechanism anywhere (D-03) — mutation executes on first request
- tsc clean; npm test 554/556 passing (2 pre-existing itglue-search failures, unrelated,
  logged in deferred-items.md, already documented by plans 24-01/24-03)

.planning/phases/24-aws-route-53-dns-sync-track-changes-crud-operations-full-aud/deferred-items.md

@@ -22,3 +22,10 @@ changes).
   `route53-write-persistence.ts`. Neither `itglue-search.ts` nor its test
   file were touched by this plan. Out of scope per the scope boundary rule —
   not fixed.
+
+## Plan 24-05
+
+- Same 2 pre-existing `lib/services/analyzer/itglue-search.test.ts` failures
+  re-surfaced by `npm test` (full suite) while verifying Task 3. Neither
+  `itglue-search.ts` nor its test file were touched by this plan. Out of
+  scope per the scope boundary rule — not fixed.