healthcheck: answer 503 when the last round of DNS checks reached no root server (closes #302)

The health check answered ok while every DNS lookup failed, as on a
network that intercepts DNS queries. A lookup whose root servers give no
usable reply now fails with ErrNoRootServerAnswered. At the end of each
round of DNS checks the watcher records whether every lookup failed with
it or with ErrIntercepted; the health check then gives status error, and
/.well-known/healthcheck and /health answer 503. Until the first round
finishes it stays ok.

The health check now depends on the watcher, so fx builds the watcher
first: its first round starts before the HTTP server listens, and the
server tests' fx graph includes it. NewWithRootServers lets tests start
a resolver's walks at real servers that are not root servers.

Model: opus-5-5

internal/resolver/errors.go

@@ -36,6 +36,12 @@ var (
 	// so whether the name has addresses is unknown.
 	ErrNoNameserverAnswered = errors.New("no nameserver answered")
 
+	// ErrNoRootServerAnswered is returned when the root servers were
+	// asked and none of them gave a usable reply, as when the host
+	// running dnswatcher has lost its network. When they all refused,
+	// the error is ErrIntercepted instead.
+	ErrNoRootServerAnswered = errors.New("no root server answered")
+
 	// ErrNoNameserverAddress is returned when a nameserver is to be
 	// asked and no address for it was given.
 	ErrNoNameserverAddress = errors.New("nameserver has no address")