Corregge il provisioning Hetzner: Faraday, cloud-init e default cpx12.

Sistemati path API /v1, AppArmor/auth MediaMTX sul nodo e defaults nbg1 così lo smoke Cloud è ripetibile.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/streams/dns_providers/hetzner.rb

@@ -12,7 +12,8 @@ module Streams
     #   STREAM_DNS_ZONE (default mltv-stream.net)
     #   STREAM_DNS_TTL (default 60)
     class Hetzner < Base
-      API = "https://api.hetzner.cloud/v1"
+      # Trailing slash obbligatorio: path assoluti altrimenti droppano /v1.
+      API = "https://api.hetzner.cloud/v1/"
 
       def initialize(token: ENV.fetch("HCLOUD_TOKEN"), zone: nil, conn: nil)
         @token = token
@@ -24,7 +25,7 @@ module Streams
       def upsert_a(name, ip)
         rr_name = relative_name(name)
         delete_a(name)
-        post("/zones/#{CGI.escape(@zone)}/rrsets", {
+        post("zones/#{CGI.escape(@zone)}/rrsets", {
           name: rr_name,
           type: "A",
           ttl: @ttl,
@@ -37,7 +38,7 @@ module Streams
       def delete_a(name)
         rr_name = relative_name(name)
         encoded = CGI.escape(rr_name)
-        response = conn.delete("/zones/#{CGI.escape(@zone)}/rrsets/#{encoded}/A") do |req|
+        response = conn.delete("zones/#{CGI.escape(@zone)}/rrsets/#{encoded}/A") do |req|
           req.headers.update(auth_headers)
         end
         return true if response.status == 404 || response.status == 204 || response.success?
@@ -47,7 +48,7 @@ module Streams
 
       def resolve(name)
         rr_name = relative_name(name)
-        data = get("/zones/#{CGI.escape(@zone)}/rrsets", name: rr_name, type: "A")
+        data = get("zones/#{CGI.escape(@zone)}/rrsets", name: rr_name, type: "A")
         rrset = Array(data["rrsets"]).first
         Array(rrset&.dig("records")).first&.dig("value")
       rescue Error