Improve Dynu env handling and document secrets/dynu.env

scripts/dynu/build_dns_inventory.sh

@@ -4,10 +4,23 @@ set -euo pipefail
 # This integration is intentionally read-only.
 # No Dynu mutations are permitted in this repo at this stage.
 
+# Optional convenience: auto-load local Dynu env file when variables are unset.
+if [[ -f "secrets/dynu.env" ]]; then
+  set -a
+  # shellcheck source=/dev/null
+  source "secrets/dynu.env"
+  set +a
+fi
+
 if [[ "${DYNU_READ_ONLY:-}" != "true" ]]; then
   echo "Refusing to run: DYNU_READ_ONLY must be exactly 'true'." >&2
   exit 2
 fi
 
+if [[ -z "${DYNU_API_KEY:-}" ]]; then
+  echo "Missing DYNU_API_KEY. Set it in env or secrets/dynu.env." >&2
+  exit 2
+fi
+
 python3 scripts/dynu/fetch_dynu_dns.py
 python3 scripts/dynu/correlate_dynu_with_traefik.py