resolver: query a hostname at its own zone's servers (closes #189)

A hostname's nameservers came from its last two labels, so a name under
co.uk was asked at the co.uk servers and a name in a delegated subdomain
at the parent's servers; both only refer onward. The hostname now goes
through FindAuthoritativeNameservers, which follows delegations for the
name and walks up its labels until it finds the zone it is in.

followDelegation now stops at an authoritative reply: that server holds
the zone, so its reply is not a referral. Without this a CNAME answered
with the zone's NS records in the authority section, as Route 53 does,
was followed as a referral until the delegation limit.

Model: opus-5-5

TODO.md

@@ -19,6 +19,8 @@ nameserver IP address changes: https://git.eeqj.de/sneak/dnswatcher/issues/105
 
 # Completed Steps
 
+- 2026-10-01: a hostname is queried at the servers of the zone it is in, found
+  by following delegations for the name, not its last two labels (closes #189).
 - 2026-10-01: a port or TLS check that shutdown cuts short saves nothing and
   sends no notification, as a cut-short DNS lookup already did (closes #185).
 - 2026-10-01: the client address from `X-Forwarded-For` is the last entry that