watcher: a port check that finds 443 closed removes its certificate entries (closes #265)

The TLS check runs only on an open port 443, and the certificate
cleanup removed an entry only when its name stopped resolving to the
address, so an entry stayed ok for as long as its port was closed.
The cleanup after the port checks now also removes the entries of an
address whose port 443 was found closed. Nothing is notified for the
removal; the Port Change already says the port closed. When the port
opens again, the next TLS check saves the certificate as new, with no
change or recovery notification. The README says both.

Judgement call: the entry goes even while none of the name's
nameservers answer, since the port check reached the address itself.

Model: opus-5-5

internal/watcher/watcher.go

@@ -978,7 +978,8 @@ func (w *Watcher) checkAllPorts(ctx context.Context) {
 
 	// Phase 3: Remove port state entries that no longer have
 	// any hostname referencing them, and certificate entries for
-	// an address their name no longer has.
+	// an address whose port 443 is closed or that their name no
+	// longer has.
 	w.cleanupStalePorts(associations)
 	w.cleanupStaleCertificates()
 }
@@ -1065,13 +1066,21 @@ func (w *Watcher) cleanupStalePorts(
 }
 
 // cleanupStaleCertificates removes the certificate entries for an
-// address their name no longer resolves to. An entry saved for a name
-// none of whose nameservers answered is kept: that name's addresses are
-// not known, not gone.
+// address whose port 443 was found closed, and for an address their
+// name no longer resolves to. An entry saved for a name none of whose
+// nameservers answered is kept unless its port is closed: that name's
+// addresses are not known, not gone.
 func (w *Watcher) cleanupStaleCertificates() {
 	for _, key := range w.state.GetAllCertificateKeys() {
 		ip, hostname := parseCertKey(key)
 
+		ps, ok := w.state.GetPortState(fmt.Sprintf("%s:%d", ip, tlsPort))
+		if ok && !ps.Open {
+			w.state.DeleteCertificateState(key)
+
+			continue
+		}
+
 		if slices.Contains(w.collectIPs(hostname), ip) ||
 			w.noNameserverAnswered(hostname) {
 			continue