feat(cdn): integrate CDN Manager into the application

- Updated environment configurations to include CDN Manager in the RETURN_TO_ALLOWLIST.
- Enhanced target app resolution to recognize CDN-related hosts.
- Added CDN Manager to the application switcher and updated relevant documentation.
- Included tests to verify the correct mapping of CDN hosts.

Co-authored-by: Cursor <[email protected]>

packages/shared/src/contracts/app-switcher.ts

@@ -47,6 +47,7 @@ const DEFAULT_ICONS: Record<AppId, AppSwitcherIconName> = {
   bgp: 'globe',
   fw: 'server',
   dns: 'globe',
+  cdn: 'cloud',
 }
 
 const DEFAULT_AUTH_MODE: Record<AppId, AppAuthMode> = {
@@ -55,6 +56,7 @@ const DEFAULT_AUTH_MODE: Record<AppId, AppAuthMode> = {
   bgp: 'jwt',
   fw: 'jwt',
   dns: 'oidc',
+  cdn: 'jwt',
 }
 
 /** Seed / fallback when DB is empty. */

packages/shared/src/contracts/audit.ts

@@ -11,6 +11,7 @@ export const AUDIT_SOURCE_APPS = [
   'bgp',
   'fw',
   'dns',
+  'cdn',
 ] as const
 export type AuditSourceApp = (typeof AUDIT_SOURCE_APPS)[number]
 export const auditSourceAppSchema = z.enum(AUDIT_SOURCE_APPS)
@@ -106,7 +107,7 @@ export type AuditPurgeResponse = z.infer<typeof auditPurgeResponseSchema>
 
 export const ingestAuditEventSchema = z.object({
   event_id: z.string().min(1).max(128),
-  source_app: z.enum(['vps', 'cfdm', 'bgp', 'fw', 'dns']),
+  source_app: z.enum(['vps', 'cfdm', 'bgp', 'fw', 'dns', 'cdn']),
   action: z.string().min(1).max(200),
   severity: auditSeveritySchema.optional(),
   actor_user_id: z.string().nullable().optional(),

packages/shared/src/contracts/auth.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod'
 
-export const APP_IDS = ['cfdm', 'vps', 'bgp', 'fw', 'dns'] as const
+export const APP_IDS = ['cfdm', 'vps', 'bgp', 'fw', 'dns', 'cdn'] as const
 export type AppId = (typeof APP_IDS)[number]
 export const appIdSchema = z.enum(APP_IDS)
 
@@ -57,6 +57,13 @@ export const APPS: AppMeta[] = [
     url: 'https://dns.shnt.top',
     authMode: 'oidc',
   },
+  {
+    id: 'cdn',
+    title: 'CDN Manager',
+    description: 'Флот DNS: ноды, алиасы, sync Cloudflare',
+    url: 'https://cdn.shnt.top',
+    authMode: 'jwt',
+  },
 ]
 
 export type CatalogSection = {
@@ -154,6 +161,19 @@ export const PERMISSION_CATALOG: AppPermissionCatalog[] = [
       section('settings', 'Настройки', 'SSO и системные настройки', ['admin']),
     ],
   },
+  {
+    appId: 'cdn',
+    title: 'CDN Manager',
+    sections: [
+      section('dashboard', 'Панель', 'KPI и обзор', ['read']),
+      section('nodes', 'Ноды', 'Канонические хосты A/AAAA'),
+      section('aliases', 'Алиасы', 'CNAME и retarget'),
+      section('zones', 'Зоны', 'Cloudflare zones и BIND export'),
+      section('sync', 'Синхронизация', 'Pull/diff/apply DNS', ['write']),
+      section('topology', 'Топология', 'Схема флота', ['read']),
+      section('settings', 'Настройки', 'Naming, TTL, Cloudflare', ['admin']),
+    ],
+  },
 ]
 
 export function permissionKey(