resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/resolver/export_test.go

@@ -17,6 +17,43 @@ func NewWithFailingTCP(log *slog.Logger) *Resolver {
 	return r
 }
 
+// NewWithQueryTimeout returns a Resolver whose queries over UDP give up
+// after timeout, so a test that asks an address where nothing answers
+// does not wait out the usual timeout.
+func NewWithQueryTimeout(log *slog.Logger, timeout time.Duration) *Resolver {
+	r := NewFromLogger(log)
+	r.client = &udpClient{timeout: timeout}
+
+	return r
+}
+
+// FollowDelegation exports followDelegation for testing.
+func (r *Resolver) FollowDelegation(
+	ctx context.Context,
+	domain string,
+	servers []string,
+) ([]string, error) {
+	return r.followDelegation(ctx, domain, servers)
+}
+
+// FindAuthoritativeNameserversFrom exports findAuthoritativeNameservers
+// for testing.
+func (r *Resolver) FindAuthoritativeNameserversFrom(
+	ctx context.Context,
+	domain string,
+	servers []string,
+) ([]string, error) {
+	return r.findAuthoritativeNameservers(ctx, domain, servers)
+}
+
+// ResolveNSIterative exports resolveNSIterative for testing.
+func (r *Resolver) ResolveNSIterative(
+	ctx context.Context,
+	domain string,
+) ([]string, error) {
+	return r.resolveNSIterative(ctx, domain)
+}
+
 // ExtractRecordValue exports extractRecordValue for testing.
 func ExtractRecordValue(rr dns.RR) string {
 	return extractRecordValue(rr)