resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/handlers/status.go

@@ -10,10 +10,12 @@ import (
 
 // statusDomainInfo holds status information for a monitored domain.
 // RecordsByNameserver holds the domain's own records, in the form a
-// hostname's Nameservers holds the hostname's.
+// hostname's Nameservers holds the hostname's. NXDomain is true when
+// the domain's parent zone's servers answered that it does not exist.
 type statusDomainInfo struct {
 	Nameservers         []string                         `json:"nameservers"`
 	RecordsByNameserver map[string]*statusHostnameNSInfo `json:"recordsByNameserver"`
+	NXDomain            bool                             `json:"nxdomain"`
 	LastChecked         time.Time                        `json:"lastChecked"`
 }
 
@@ -155,6 +157,7 @@ func buildDomains(
 		resp.Domains[name] = &statusDomainInfo{
 			Nameservers:         ns,
 			RecordsByNameserver: records,
+			NXDomain:            ds.NXDomain,
 			LastChecked:         ds.LastChecked,
 		}
 	}