watcher: a name removed from the targets leaves the state (closes #223)

At startup, before the first check, Run removes from the loaded state
the domain, hostname and certificate entries of names no longer in
DNSWATCHER_TARGETS, takes those names off each port entry's list of
names and removes a port entry left with none, so the dashboard,
/api/v1/status and the startup notification count only configured
names. A configured domain's own records, saved as a hostname entry
under its name, are kept. Nothing is notified. Each port check, next to
the removal of stale port entries, now also removes the certificate
entries for an address a name no longer resolves to, except while none
of its nameservers answered, as port entries already were.

Model: opus-5-5

README.md

@@ -245,6 +245,14 @@ clears them.
   false-positive change notifications.
 - State is written atomically (write to temp file, then rename) to prevent
   corruption.
+- A name removed from `DNSWATCHER_TARGETS` is removed from the state at startup,
+  before the first check, without a notification: its domain, hostname and
+  certificate entries go, it is taken off each port entry's list of names, and a
+  port entry left with no name goes, so the dashboard and `/api/v1/status` no
+  longer list or count it. The first check's port checks remove the port entries
+  of addresses no configured name has.
+- Each port check also removes the certificate entries for an address their name
+  no longer resolves to, except while none of the name's nameservers answer.
 
 ### Web Dashboard
 
@@ -734,7 +742,8 @@ docker run -d \
 1. **Startup**: Check that the data directory can be written, and exit with an
    error naming it if not. Load state from disk. If no state file exists, start
    with empty state (first check will establish baseline without triggering
-   change notifications).
+   change notifications). Remove from the state the names no longer in
+   `DNSWATCHER_TARGETS` (see State Management).
 2. **Initial check**: Immediately perform all DNS, port, and TLS checks on
    startup.
 3. **Periodic checks** (DNS always runs first):