feat: add secure Pi-hole DNS management

internal/model/model.go

@@ -72,6 +72,36 @@ type CNAMERecord struct {
 	UpdatedAt   time.Time
 }
 
+// PiHoleIntegration is one remotely managed Pi-hole v6 instance. API
+// passwords are returned separately and never exposed to templates.
+type PiHoleIntegration struct {
+	ID          int64
+	Name        string
+	BaseURL     string
+	InsecureTLS bool
+	CreatedAt   time.Time
+	UpdatedAt   time.Time
+	LastSyncAt  time.Time
+	LastError   string
+}
+
+type PiHoleCredential struct {
+	Ciphertext []byte
+	Nonce      []byte
+}
+
+// PiHoleRecordLink tracks whether a local DNS entry is managed by this UI or
+// merely retained at Pi-hole after being removed from the active WebUI list.
+type PiHoleRecordLink struct {
+	ID            int64
+	IntegrationID int64
+	Active        bool
+	Value         string
+	CreatedAt     time.Time
+	UpdatedAt     time.Time
+	ArchivedAt    time.Time
+}
+
 type User struct {
 	ID          int64
 	Username    string