fix: remove Route53 endpoint override and pin AWS SDK to an aged version

The endpoint field let anyone with dnsProvider create permission point
the AWS SDK at an arbitrary URL (loopback, link-local, internal
network, cloud metadata), turning testConnection and every other
Route53 operation into an SSRF oracle. There's no way to keep
LocalStack-style testing working while blocking that, since the
target address is identical either way, so the field is removed
entirely rather than validated. Route53 always talks to real AWS now.

Also pin @aws-sdk/client-route-53 to ^3.1097.0 (matching the existing
client-secrets-manager pin) instead of whatever caret-latest resolved
to at install time. The version that landed in the merged PR was
published less than a day before this, which violates the
minimumReleaseAge policy that merged into canary around the same time
and broke the Docker build.

packages/server/package.json

@@ -37,7 +37,7 @@
     "@ai-sdk/mistral": "^3.0.20",
     "@ai-sdk/openai": "^3.0.29",
     "@ai-sdk/openai-compatible": "^2.0.30",
-    "@aws-sdk/client-route-53": "^3.1108.0",
+    "@aws-sdk/client-route-53": "^3.1097.0",
     "@aws-sdk/client-secrets-manager": "^3.1097.0",
     "@better-auth/api-key": "1.6.23",
     "@better-auth/passkey": "1.6.23",

packages/server/src/db/schema/dns-provider.ts

@@ -18,7 +18,6 @@ export const route53DnsConfigSchema = z.object({
 	providerType: z.literal("route53"),
 	accessKeyId: z.string().trim().min(1),
 	secretAccessKey: z.string().trim().min(1),
-	endpoint: z.string().trim().url().optional(),
 });
 
 export const dnsProviderConfigSchema = z.discriminatedUnion("providerType", [

packages/server/src/utils/dns/route53.ts

@@ -18,7 +18,6 @@ const createClient = (config: Route53Config) =>
 			accessKeyId: config.accessKeyId,
 			secretAccessKey: config.secretAccessKey,
 		},
-		...(config.endpoint && { endpoint: config.endpoint }),
 	});
 
 const stripTrailingDot = (name: string) => name.replace(/\.$/, "");