resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/watcher/watcher.go

@@ -289,6 +289,13 @@ func (w *Watcher) checkDomain(
 	domain string,
 ) {
 	nameservers, err := w.resolver.LookupNS(ctx, domain)
+
+	// A domain that does not exist has no nameservers.
+	nxdomain := errors.Is(err, resolver.ErrNXDomain)
+	if nxdomain {
+		nameservers, err = []string{}, nil
+	}
+
 	if err != nil {
 		w.logFailedLookup(
 			ctx,
@@ -323,9 +330,18 @@ func (w *Watcher) checkDomain(
 	w.state.SetDomainState(domain, &state.DomainState{
 		Nameservers:         nameservers,
 		NameserverAddresses: addresses,
+		NXDomain:            nxdomain,
 		LastChecked:         now,
 	})
 
+	// A domain that does not exist has no records of its own: none are
+	// asked for, and those saved by an earlier check are removed.
+	if nxdomain {
+		w.state.DeleteHostnameState(domain)
+
+		return
+	}
+
 	// The apex domain's records are also checked and saved as a
 	// hostname's, so that the port and TLS checks find its addresses.
 	// Notifications about them name it as a domain (see nameLine).