[zquestz]

Make the minimum cache TTL configurable (CACHE_MIN_TTL)

Summary

Unbound and encrypted-dns both cache answers for at least one hour
(cache-min-ttl: 3600 and cache_ttl_min = 3600), even when a record's TTL is
shorter. That's a good default for a busy public resolver, but it means record
changes can take an hour or more to reach clients, which is noticeable on
smaller servers.

This adds an optional CACHE_MIN_TTL environment variable, in seconds from 0 to
86400, that sets the minimum for both caches. Without it, the one-hour default
is kept, so existing deployments behave exactly as before.

Usage

docker run ... -e CACHE_MIN_TTL=60 ...

CACHE_MIN_TTL=0 honors the TTLs set by the zone owners.

Changes

• entrypoint.sh: start() validates CACHE_MIN_TTL and refuses to start with
  a clear error if it isn't a number from 0 to 86400. Leading zeros are stripped,
  since TOML doesn't allow them. The value (or 3600 when unset) is written to
  cache_ttl_min in the encrypted-dns config in the keys volume, only when it
  differs from what's already there. It's passed to Unbound through
  /etc/cache-min-ttl-env, the same way OPENNIC is, since runit clears the
  environment before starting services.
• unbound.sh: cache-min-ttl is filled in from CACHE_MIN_TTL, defaulting to
  3600.
• README.md: new "Cache TTL" section.

Testing

• bash -n and shellcheck on both scripts: no new findings.
• Validation tested with accepted values (0, 60, 0060, 86400) and
  rejected ones (86401, abc, -5, 1e3, a 21-digit number).
• Built the image and checked the generated unbound.conf and
  encrypted-dns.toml with the variable set to 60, unset, and invalid.
• Deployed on GKE with OPENNIC=1 and CACHE_MIN_TTL=0: the generated
  unbound.conf has cache-min-ttl: 0, the encrypted-dns config has
  cache_ttl_min = 0, and all services run normally.