refactor: Stage 3: Migrate remaining providers to providers.Register

[TomOnTime]

Stage 3 of the provider registration redesign. Depends on #4956; this PR targets tlim_stage2_unify so the diff contains only Stage 3. Retarget to main after Stage 2 merges.

Migrate the remaining 70 providers to providers.Register, with receiver-based initialization and auditing. All 75 providers now have unified definitions. Move AuditRecords into models.DNSProvider and remove the temporary RecordAuditingProvider interface and separate registration check.

• Preserve constructor validation, per-account/per-role instances, metadata, observers, maintainers, default TTLs, record identity, and existing custom-record registrations. Inline single-use registration constants and feature maps.
• Populate fresh receivers directly, including the DNS Made Easy, Gidinet, and Loopia client helpers. Retain constructor adapters only in existing tests.
• Adopt Stage 2's derived documentation URLs: omit redundant declarations and keep five legacy-path overrides. Correct Gandi/Hetzner URLs to their existing documentation pages and update the provider-writing example to omit the default URL.
• Keep legacy registry views and consumers for Stage 4. Custom-record registration remains until the Stage 5–6 SupportedTypes rollout.

Interface discovery corrects existing capability declarations:

• AUTODNS and EXOSCALE already implement zone creation and now advertise it.
• DNSCALE, DYNU, LINODE, MYTHICBEASTS, and OPENWRT do not implement ListZones and no longer advertise zone listing.
• Remove no-op EnsureZoneExists methods from AZURE_PRIVATE_DNS and MIKROTIK. Azure Private DNS no longer advertises creation; MikroTik retains its false capability.
• Regenerate provider capability pages and the matrix. The broader JavaScript documentation rollout remains separate.

Validation: go test ./..., bin/generate-all.sh (including go fix, golangci-lint with 0 issues, and staticcheck), and git diff --check pass. New tests cover all-provider registration and credential-free auditing, derived capabilities, account/role/limiter isolation, observer injection, metadata/error propagation, and Hetzner cache callbacks bound to the runtime receiver. A before/after registry comparison confirms unchanged roles, maintainers, TTLs, credential fields, and non-interface-derived feature notes; providers previously lacking credential metadata gain friendly names and derived roles. Documentation URLs follow Stage 2's defaults with explicit legacy overrides. No live provider integration profile was selected.