fix: restore session cleanup and implement force delete-before-create

Session cleanup:
- Restore cleanupOnStop goroutine that was accidentally removed in ProviderMeta refactor
- Sessions are now properly logged out when terraform exits
- Prevents "API seats exceeded" errors from stale session accumulation

Force flag:
- Implement actual upsert behavior for DNS records
- When force=true and record exists, delete it before creating
- Pi-hole v6 API doesn't support force query param, so implement client-side
- Update description to reflect working functionality

Fixes session exhaustion and "item already present" errors during terraform apply.

Author: poindexter12

internal/pihole/v6/dns.go

@@ -65,16 +65,26 @@ func (s *dnsService) Get(ctx context.Context, domain string) (*pihole.DNSRecord,
 }
 
 // Create adds a new DNS record.
+// If opts.Force is true and the record already exists, it will be deleted first.
 // Includes retry logic for transient errors that can occur during
 // ForceNew operations when Pi-hole hasn't fully processed a prior delete.
 func (s *dnsService) Create(ctx context.Context, domain, ip string, opts *pihole.CreateOptions) (*pihole.DNSRecord, error) {
-	path := fmt.Sprintf("%s/%s", dnsHostsPath, url.PathEscape(ip+" "+domain))
-
-	// Append force parameter if requested
+	// If force is requested and record exists, delete it first
 	if opts != nil && opts.Force {
-		path += "?force=true"
+		existing, err := s.Get(ctx, domain)
+		if err == nil && existing != nil {
+			// Record exists - delete it first
+			if delErr := s.Delete(ctx, domain); delErr != nil {
+				return nil, fmt.Errorf("force delete failed: %w", delErr)
+			}
+			// Brief pause to let Pi-hole process the delete
+			time.Sleep(100 * time.Millisecond)
+		}
+		// If err != nil (not found), that's fine - proceed with create
 	}
 
+	path := fmt.Sprintf("%s/%s", dnsHostsPath, url.PathEscape(ip+" "+domain))
+
 	const maxRetries = 5
 	var lastErr error
 	for attempt := 0; attempt < maxRetries; attempt++ {

internal/provider/provider.go

@@ -4,9 +4,11 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/poindexter12/terraform-provider-pihole/internal/pihole"
 	"github.com/poindexter12/terraform-provider-pihole/internal/version"
 )
 
@@ -76,7 +78,28 @@ func configure(version string, provider *schema.Provider) func(ctx context.Conte
 			return nil, diag.FromErr(fmt.Errorf("failed to instantiate client: %w", err))
 		}
 
+		// Only register cleanup for sessions we created ourselves.
+		// Don't logout sessions passed in via __PIHOLE_SESSION_ID as those
+		// are managed externally (e.g., for testing or session pooling).
+		if externalSessionID == "" {
+			if stopCtx, ok := schema.StopContext(ctx); ok {
+				go cleanupOnStop(stopCtx, piholeClient)
+			}
+		}
+
 		// Return ProviderMeta which wraps the client and provides coordination
 		return &ProviderMeta{Client: piholeClient}, nil
 	}
 }
+
+// cleanupOnStop waits for the stop context to be cancelled
+// and then logs out the Pi-hole session to free up the session slot.
+func cleanupOnStop(stopCtx context.Context, client pihole.Client) {
+	<-stopCtx.Done()
+
+	// Use a fresh context for logout since stopCtx is cancelled
+	logoutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	_ = client.Logout(logoutCtx) // Best effort - ignore errors
+}

internal/provider/resource_dns_record.go

@@ -35,7 +35,7 @@ func resourceDNSRecord() *schema.Resource {
 				ValidateDiagFunc: validateIPAddress(),
 			},
 			"force": {
-				Description: "Attempt to force record creation. Note: Pi-hole v6 API currently does not implement this for DNS endpoints, but it is included for forward compatibility with future Pi-hole versions.",
+				Description: "If true and the record already exists, delete it before creating the new record. Enables upsert/overwrite behavior.",
 				Type:        schema.TypeBool,
 				Optional:    true,
 				Default:     false,